Reply to thread

Message

<blockquote data-quote="Parsh" data-source="post: 867316" data-attributes="member: 58090">This is a very valid concern even I have and I&#039;m sure many others here will. There should be no blindfold when it comes to trusted apps.First of all, KIS uses multiple params like Application Trust Inheritance principle, Digital signature, source etc. to form a trust chain for categorizing files.If you read the &quot;security corridor&quot; aspect of Application Control (the pillar of TAM) in their <a href="http://media.kaspersky.com/pdf/kaspersky_lab_whitepaper_trusted_applications_mode.pdf" target="_blank">whitepaper</a>, they do monitor the trusted apps for suspicious actions they are not meant to perform. While we do not know well the scope of their monitoring (not talking about the options in AC), it is true that they do not blindly trust the trusted applications.A year back when i was installing Windows pre-installation environment through Macrium Reflect, KIS intervened saying a suspicious action has been blocked. That was the System Watcher, that along with File AV and AC, is a part of TAM. KIS hence had a watch on the trusted Macrium app. Possibly KIS didn&#039;t have info that this is a common action for Macrium Reflect.It apparently monitors common apps for unexpected actions and other allowed programs for suspicious actions. Just the threshold may vary.Design limitations or a higher threshold set to reduce FPs might lead to TAM missing some malicious action by a trusted file that otherwise should have been blocked. That can be expected of any such consumer program.If I recollect well, Kaspersky&#039;s memory scanning had protected systems during a considerable malware outbreak in the recent past. They just need to keep progressing.Anyway, TAM is off the cards now and as [USER=36043]@harlan4096[/USER] said, AC can be better tweaked to simulate a flexible TAM.</blockquote>

[QUOTE="Parsh, post: 867316, member: 58090"] This is a very valid concern even I have and I'm sure many others here will. There should be no blindfold when it comes to trusted apps. First of all, KIS uses multiple params like Application Trust Inheritance principle, Digital signature, source etc. to form a trust chain for categorizing files. If you read the "security corridor" aspect of Application Control (the pillar of TAM) in their [URL='http://media.kaspersky.com/pdf/kaspersky_lab_whitepaper_trusted_applications_mode.pdf']whitepaper[/URL], they do monitor the trusted apps for suspicious actions they are not meant to perform. While we do not know well the scope of their monitoring (not talking about the options in AC), it is true that they do not blindly trust the trusted applications. A year back when i was installing Windows pre-installation environment through Macrium Reflect, KIS intervened saying a suspicious action has been blocked. That was the System Watcher, that along with File AV and AC, is a part of TAM. KIS hence had a watch on the trusted Macrium app. Possibly KIS didn't have info that this is a common action for Macrium Reflect. It apparently monitors common apps for unexpected actions and other allowed programs for suspicious actions. Just the threshold may vary. Design limitations or a higher threshold set to reduce FPs might lead to TAM missing some malicious action by a trusted file that otherwise should have been blocked. That can be expected of any such consumer program. If I recollect well, Kaspersky's memory scanning had protected systems during a considerable malware outbreak in the recent past. They just need to keep progressing. Anyway, TAM is off the cards now and as [USER=36043]@harlan4096[/USER] said, AC can be better tweaked to simulate a flexible TAM. [/QUOTE]

Verification