Battle Cyberlock vs WDAC-ISG

[Azazel]

Cyberlock on Autopilot
WDAC-ISG similar to whhlight in super safe (No Whitelist)

What do you think is better more robust.

 

[Victor M]

I meticulously create hash rules for the applications I use. I believe a whitelist is better than a generic allow everything installed rule. An intruder-app maybe installed without your knowledge if it bypasses your detection mechs. You can't trust your automated detection mechs, they are just for good measure.

 

[Andy Ful]

WDAC-ISG similar to whhlight in super safe (No Whitelist)

WDAC-ISG is similar to one-third of WHHLight (when one skips SWH settings and WHHLight tools).
WDAC-ISG cannot be managed on Windows Home (if one does not use WHHLight).
For EXE files, WDAC-ISG can be probably compared to the Cyberlock file lookup in VirusTotal + WhitelistCloud.
WDAC-ISG can detect/block loading DLLs but CyberLock can apply more comprehensive anti-script + LOLBin protection.

I do not think that anyone could reliably settle which one is better and more robust.
See also:

Serious Discussion - Is AppGuard better than WDAC and CyberLock ?

Looking at the AppGuard web site, it seems to do default deny with allowed applications thru behavior? Is this better than WDAC and CyberLock ?

malwaretips.com

 

[danb]

We could always add a WDAC mode to CyberLock. I have been toying with doing this for years, but never really found a great reason to do so. There are a lot of cons for WDAC, like 1) not being able to whitelist items on the fly, 2) total lack of context (which is absolutely vital to properly securing a system), 3) being forced to globally block LOLBins to be able to protect against them. That, and the fact that 4) WDAC is completely unusable without ISG, and easily bypassable with ISG. And 5) the basline WDAC policies are an absolute mess, and only block based on a single criteria, not multiple like CyberLock.

I am guessing that if CyberLock offered a WDAC mode, most users would not use it. Maybe it would be good for SMB / Enterprise, especially as a method to quickly build and manage policies. But it might be pretty cool to have WDAC block most of the executable file types, then have CyberLock's kernel mode driver block the other 100 or so file types, LOLBins, fileless malware, etc.

If someone can provide one massive advantage for adding a WDAC mode to CyberLock, I would be happy to do so.