Discussion Thread CyberLock: Mode, Security Posture, and Rules

[rhythm]

CyberLock: Mode, Security Posture, and Rules

I find the mode, security posture, and rules to be confusing. CyberLock's functionality is based on the Mode selected. The security posture and rules don't make a difference. Mode and Security Posture have similarities. For example, Smart mode and Aggressive security posture have identical protection criteria. I think Rules should replace the Security Posture. For example, Rules should contain the Ruleset created under the Rules section (empty by default). Users can choose either the default Mode or their own Ruleset.

The aim is to keep it simple, allowing users to go with the default protection or create and use their own.

What do you think, guys, and @danb?

 

[danb]

Thank you for the suggestion! There are actually quite a bit of differences in functionality between Modes and Security Postures.

The way CyberLock is currently...

Security Postures: They are a simple and quick way for the user to adjust the overall security posture of CyberLock.

Rules: The Rules feature is really meant for special situations that are not covered by Security Postures, and most users do not need to create any rules.

But let me think it over, you might be on to something here. We just do not want users to have to create a bunch of rules that could be covered by the Modes and Security Postures features in a very simple way.

 

[rhythm]

I believe the ON, Smart, and Auto modes provide the perfect balance of security, from maximum to optimum. Users have the option to use Ruleset for their desired protection.

What I meant was this:
The CyberLock Mode drop-down menu features two choices: Default and Custom.
CyberLock Mode's "Default" selection causes the Security Posture drop-down menu to show ON, Smart, and Auto.
CyberLock Mode’s "Custom" selection causes the Security Posture drop-down menu to show the ruleset(s) created in the Rules section.

Users would have the flexibility to choose preconfigured default security or their own ruleset.

 

[rhythm]

The Rules section is why I began this thread. I tried it and experimented with it. I assumed I could create and use my protection thresholds via Ruleset, but it seems not to be the case.

To summarize, “The ability to use my own Ruleset for protection is what I desire.”

 

[danb]

The Rules section is why I began this thread. I tried it and experimented with it. I assumed I could create and use my protection thresholds via Ruleset, but it seems not to be the case.

To summarize, “The ability to use my own Ruleset for protection is what I desire.”

Thanks again for the suggestions... we can certainly brainstorm to see what we come up with.

I think this will help me understand even better... can you please write out a rule that you would like to be able to create in CyberLock? Or maybe a few examples would be even better.

 

[rhythm]

CL defaults well serve most users. Users with advanced knowledge can adjust settings to their liking.

The security software and users involved would determine whether I use CL, AI, or WC on systems. Therefore, I'm interested in the Ruleset. Ruleset has the potential to serve as a dependable personalized mode for users who desire to change CL's protection features or AI thresholds based on their security requirements.
For example, I can tailor my security preferences using VoodooAi, Digital Signatures, and WhitelistCloud, standalone or in combination, based on my preferences, security requirements, and the users involved.

Have you considered launching a standalone VoodooAi, like the standalone Behavior Blockers in the old days?

 

[danb]

CL defaults well serve most users. Users with advanced knowledge can adjust settings to their liking.

The security software and users involved would determine whether I use CL, AI, or WC on systems. Therefore, I'm interested in the Ruleset. Ruleset has the potential to serve as a dependable personalized mode for users who desire to change CL's protection features or AI thresholds based on their security requirements.
For example, I can tailor my security preferences using VoodooAi, Digital Signatures, and WhitelistCloud, standalone or in combination, based on my preferences, security requirements, and the users involved.

Have you considered launching a standalone VoodooAi, like the standalone Behavior Blockers in the old days?

Interesting, thank you for the suggestion, let me think about that for a while and see what we might be able to do.

Yeah, we already have a free stand alone version of WhitelistCloud, which utilizes VoodooAi. We would need to build it out a little more, but the basic components are ready. If you ask me, it is a great second opinion scanner for running processes. All files known to be safe are marked as Safe, and any file that is not known to be safe is marked as Not-Safe.

http://www.whitelistcloud.com/Download/InstallWhitelistCloud.exe

 

[rhythm]

Does WhitelistCloud work in real-time like the one in CL?

A real-time and standalone VoodooAi is what I am referring to. The protection thresholds of VoodooAi range from safe to unsafe, with values 0 to 100. Users can personalize it to fit their preferences.
For example:
If I were using Kaspersky, a robust, layered suite, I would configure VoodooAi to block unsafe files only.
If I were using ESET, which has strong signatures but no proactive security, I would configure VoodooAi to “allow less than or equal to 80 (or 75)”.
If I were using Microsoft Defender (a good base security), I would configure VoodooAi to allow safe files only or configure it to “allow less than or equal to 70 (or 65)”.

I'm presently observing the VoodooAi thresholds with CL. Could you share the thresholds (score ranges) for safe, suspicious, and unsafe?

 

[simmerskool]

Does WhitelistCloud work in real-time like the one in CL?

Yes WLC solo works in real time.

 

[danb]

Yes WLC solo works in real time.

Yes, it works in real time, but please do not run the WLC stand alone app by itself, that would not be wise. We have a lot to do to the WLC app before it could possibly replace a good AV.