Cylance Smart Antivirus

[Deleted member 178]

There is 2 kind of approach to security:

1- learn and learn and learn (as i did) then use "advanced" products to lock my system. This is the IT approach using specific "corporate" tools/products.
2- do nothing and expecting an "all-knowing" ultimate product that will keep them safe whatever dumb action they do. This is the home user approach using hyped software then complain how it couldn't prevent the infection.

Guess what? n°1 will probably rarely get infected...

 

[ForgottenSeer 58943]

Right, now I know who am I believing that more advanced race exists other than humans and hoping that AI might help in future computing/technology environment. Dumbass government who uselessly waste 30% of my salary in taxes to use Cylance on their systems. Riot soon in my country, see you in news. :emoji_ok_hand:

Smart guy, and yes they do exist. Also know, AI will likely be our best defense against them and many aren't entirely benign. The reason is, humans can be manipulated through doubt, emotion and subjective nature of their suppositions. AI can't be, and works from datasets fed into it and branching paths based on probabilities for the outcome the AI desires. We already sort of know this, along with other handy things like the frequencies they tend to piggyback, their limitations as well as their seemingly paranormal technology. So we've made considerable progress in this area and AI will likely be a asset in all of it. The ability to discover malware that won't exist for a few years can't be overstated.

I believe traditional security software will adapt and morph into AI/ML solutions or they'll fail to keep up. Also as the datasets for AI/ML systems continue to expand exponentially malware authors will lose the capability in some cases to code threats that will work. This is why AI/ML systems are causing some anger in those criminal communities. (and intel) Everything eventually comes to an end, and malware as we know it today will probably not exist like it does today years down the road. Either from security solutions that are quite advanced, or operating systems/devices that are well constructed to deal with it.

We already know products like Cylance are growing 'infuriating' to some of those coders because they can't tweak and upload samples to VT until they find a working bypass, and the dataset changes what the response is almost as quick as they code. It will only get more effective as time goes on. Another example is - as EDU replaces everything with Chromebooks, attack vectors of EDU environments shrink to almost nothing, further infuriating the malware coding kiddies. Their very existence is threatened by all of this.

Trend Micro HES is set to release an AI/ML based email spam/phishing technology that will almost assuredly eliminate all potential for spoofing of company executives and phishing. This system 'watches' the email of company officers over time. It develops thousands upon thousands of 'traits' of that person. How they spell, paragraph formatting, typographical nuances, etc. Then this profile is added to the dataset and any variances of it are flagged as business email compromises/phishing. In testing we've only seen 1 phishing email pass through 900,000+ email traffic flow during the BEC test. Phishing is effectively dead when this goes live because phisherman have no way to determine what the thousands of datasets and paths are.

Curbing the BEC Problem Using AI and Machine Learning - Security News - Trend Micro AU

 

[stefanos]

I know but I test avast+SH because I believe they are the best free combo for complete novice users without having to use a complicated anti-exe
even kaspersky+SH with the same settings would fail in 1 or 2 tests but not for avast+SH as I described how they work: avast's hardened mode blocks all exe malwares, SH blocks all scripts => 100%
avast might not be the best AV, I tested it with tweaked settings alone and everyone knows it's nowhere near kaspersky free

SH completely patches avast's weakness against scriptors
I test them for own purpose

I always test some products with tweaked settings, for example, WD with max settings because people usually say "WD with tweaked is enough, better than third-party AVs". I'm here to answer that question because not everyone is willing to do that

I will test WD in default settings + smartscreen to demonstrate how weak they are and where the weaknesses are

if you did not do the test Avast+syshardener would not have learned how safe I am with this combo. I would not know how safe it is osarmor or syshardener. I love your test and i learn many things. Easy cheap security solutions and for (noobs) like me. Thanks for all your tips. Hear is MalwareTips forum not security ads forum

 

[ForgottenSeer 58943]

For business users it's best where IT installs programms for you, configures it and lock downs employees PC. As a low technical skill cap home ape, I'd rather watch and follow development of new default-allow security software made and more advanced Alien Ai.

Businesses don't need solutions like Appguard which is why *I* think it's dead in the water in the corporate/enterprise world and probably BETTER suited as a consumer application. (no offense) Almost all of what Appguard does can be accomplished with GP, AD control and Limited User Accounts. I know this because it's how we lock down critical systems. Enforcement of GP's to the extent that even programs and features is unavailable. Blocking registry editing, MSI installers, everything else, all right there in AD enforced GP's. Install the software required for minimum business operation then push the GP out and presto. Done deal. Why would a third party tool be needed?

Name Allowed Permissions Inherited
NT AUTHORITY\Authenticated Users Read (from Security Filtering) No
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS Read No
NT AUTHORITY\SYSTEM Edit settings, delete, modify security No
localdomain\Domain Admins Edit settings, delete, modify security No
localdomain\Domain Computers Read (from Security Filtering) No
localdomain\Domain Controllers Read (from Security Filtering) No
localdomain\Domain Users Read (from Security Filtering) No
localdomain\Enterprise Admins Edit settings, delete, modify security No
Computer Configuration (Enabled)
Windows Settings
Security Settings
Account Policies/Password Policy
Policy Setting
Enforce password history 24 passwords remembered
Maximum password age 90 days
Minimum password age 30 days
Minimum password length 14 characters
Password must meet complexity requirements Enabled
Store passwords using reversible encryption Disabled
Account Policies/Account Lockout Policy
Policy Setting
Account lockout duration 30 minutes
Account lockout threshold 5 invalid logon attempts
Reset account lockout counter after 30 minutes
Account Policies/Kerberos Policy
Policy Setting
Enforce user logon restrictions Enabled
Maximum lifetime for service ticket 600 minutes
Maximum lifetime for user ticket 10 hours
Maximum lifetime for user ticket renewal 34 days
Maximum tolerance for computer clock synchronization 5 minutes
Local Policies/Audit Policy
Policy Setting
Audit account logon events Success, Failure
Audit account management Failure
Audit directory service access Failure
Audit logon events Success, Failure
Audit object access Failure
Audit policy change Failure
Audit privilege use Failure
Audit process tracking Failure
Audit system events Failure
Local Policies/User Rights Assignment
Policy Setting
Add workstations to domain BUILTIN\Administrators
Deny log on locally time
Take ownership of files or other objects BUILTIN\Administrators
Local Policies/Security Options
Accounts
Policy Setting
Accounts: Administrator account status Enabled
Accounts: Guest account status Disabled
Accounts: Limit local account use of blank passwords to console logon only Enabled
Accounts: Rename guest account "NoGuests"
Audit
Policy Setting
Audit: Audit the access of global system objects Enabled
Audit: Audit the use of Backup and Restore privilege Enabled
Audit: Shut down system immediately if unable to log security audits Disabled
Devices
Policy Setting
Devices: Allow undock without having to log on Disabled
Devices: Allowed to format and eject removable media Administrators
Devices: Prevent users from installing printer drivers Disabled
Devices: Restrict CD-ROM access to locally logged-on user only Enabled
Devices: Restrict floppy access to locally logged-on user only Enabled
Devices: Unsigned driver installation behavior Warn but allow installation
Domain Controller
Policy Setting
Domain controller: Allow server operators to schedule tasks Enabled
Domain controller: LDAP server signing requirements None
Domain controller: Refuse machine account password changes Disabled
Domain Member
Policy Setting
Domain member: Digitally encrypt secure channel data (when possible) Enabled
Domain member: Digitally sign secure channel data (when possible) Enabled
Domain member: Disable machine account password changes Disabled
Domain member: Maximum machine account password age 30 days
Domain member: Require strong (Windows 2000 or later) session key Enabled
Interactive Logon
Policy Setting
Interactive logon: Do not display last user name Enabled
Interactive logon: Do not require CTRL+ALT+DEL Disabled
Interactive logon: Number of previous logons to cache (in case domain controller is not available) 10 logons
Interactive logon: Prompt user to change password before expiration 14 days
Interactive logon: Require Domain Controller authentication to unlock workstation Enabled
Interactive logon: Require smart card Disabled
Interactive logon: Smart card removal behavior No Action
Microsoft Network Client
Policy Setting
Microsoft network client: Digitally sign communications (if server agrees) Enabled
Microsoft network client: Send unencrypted password to third-party SMB servers Disabled
Microsoft Network Server
Policy Setting
Microsoft network server: Amount of idle time required before suspending session 30 minutes
Microsoft network server: Digitally sign communications (if client agrees) Enabled
Microsoft network server: Disconnect clients when logon hours expire Enabled
Network Access
Policy Setting
Network access: Allow anonymous SID/Name translation Disabled
Network access: Do not allow anonymous enumeration of SAM accounts Enabled
Network access: Do not allow anonymous enumeration of SAM accounts and shares Enabled
Network access: Do not allow storage of credentials or .NET Passports for network authentication Enabled
Network access: Let Everyone permissions apply to anonymous users Disabled
Network access: Named Pipes that can be accessed anonymously COMNAP, COMNODE, SPOOLSS, LLSRPC, BROWSER, netlogon, lsarpc, samr
Network access: Shares that can be accessed anonymously COMCFG, DFS$
Network access: Sharing and security model for local accounts Classic - local users authenticate as themselves
Network Security
Policy Setting
Network security: Do not store LAN Manager hash value on next password change Enabled
Network security: Force logoff when logon hours expire Enabled
Network security: LAN Manager authentication level Send NTLMv2 response only
Network security: LDAP client signing requirements Negotiate signing
Network security: Minimum session security for NTLM SSP based (including secure RPC) clients Enabled
Require message integrity Disabled
Require message confidentiality Disabled
Require NTLMv2 session security Enabled
Require 128-bit encryption Disabled
Network security: Minimum session security for NTLM SSP based (including secure RPC) servers Enabled
Require message integrity Disabled
Require message confidentiality Disabled
Require NTLMv2 session security Enabled
Require 128-bit encryption Disabled
Recovery Console
Policy Setting
Recovery console: Allow automatic administrative logon Disabled
Recovery console: Allow floppy copy and access to all drives and all folders Disabled
Shutdown
Policy Setting
Shutdown: Allow system to be shut down without having to log on Disabled
Shutdown: Clear virtual memory pagefile Enabled
System Cryptography
Policy Setting
System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing Disabled
System Objects
Policy Setting
System objects: Default owner for objects created by members of the Administrators group Administrators group
System objects: Require case insensitivity for non-Windows subsystems Enabled
System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) Enabled
Other
Policy Setting
DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax "O:BAG:BADA;;CCDC;;;AN)(A;;CCDCLC;;;S-1-5-32-562)(A;;CCDCLC;;;WD)"
DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax "O:BAG:BADA;;CCDCLCSWRP;;;BA)(A;;CCDCSW;;;WD)(A;;CCDCLCSWRP;;;S-1-5-32-562)"
Interactive logon: Display user information when the session is locked Do not display user information
Registry Values
Policy Setting
MACHINE\Software\Policies\Microsoft\Cryptography\ForceKeyProtection 1
MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths\Machine System\CurrentControlSet\Control\ProductOptions, System\CurrentControlSet\Control\Server Applications, Software\Microsoft\Windows NT\CurrentVersion
MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems\optional Posix
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess 1
Event Log
Policy Setting
Prevent local guests group from accessing application log Enabled
Prevent local guests group from accessing security log Enabled
Prevent local guests group from accessing system log Enabled
System Services
Abel (Startup Mode: Disabled)
Permissions
Type Name Permission
Allow NT AUTHORITY\INTERACTIVE Read
Allow NT AUTHORITY\SYSTEM Full Control
Auditing
Type Name Access
Failure Everyone Full Control
Alerter (Startup Mode: Disabled)
Permissions
No permissions specified
Auditing
No auditing specified
ClipBook (Startup Mode: Disabled)
Permissions
No permissions specified
Auditing
No auditing specified
Messenger (Startup Mode: Disabled)
Permissions
No permissions specified
Auditing
No auditing specified
Telnet (Startup Mode: Disabled)
Permissions
No permissions specified
Auditing
No auditing specified
Public Key Policies/Autoenrollment Settings
Policy Setting
Enroll certificates automatically Enabled
Renew expired certificates, update pending certificates, and remove revoked certificates Enabled
Update certificates that use certificate templates Enabled
Public Key Policies/Encrypting File System
Properties
Policy Setting
Allow users to encrypt files using Encrypting File System (EFS) Enabled
Public Key Policies/Trusted Root Certification Authorities
Properties
Policy Setting
Allow users to select new root certification authorities (CAs) to trust Enabled
Client computers can trust the following certificate stores Third-Party Root Certification Authorities and Enterprise Root Certification Authorities
To perform certificate-based authentication of users and computers, CAs must meet the following criteria Registered in Active Directory only
Administrative Templates
Network
Policy Setting
Sets how often a DFS Client discovers DC's Enabled
Time in minutes: 15
Network/Background Intelligent Transfer Service
Policy Setting
Maximum network bandwith that BITS uses Enabled
Limit BITS transfer rate (Kbps) to: 25
From 8 AM
to 5 PM
At all other times
Use all available unused bandwidth Disabled
OR
Limit BITS transfer rate (Kbps) to: 50
Policy Setting
Timeout (days) for inactive jobs Enabled
Inactive Job Timeout in Days: 10
Network/Offline Files
Policy Setting
Allow or Disallow use of the Offline Files feature Disabled
Remove 'Make Available Offline' Enabled
Turn off reminder balloons Enabled
System/Error Reporting
Policy Setting
Configure Error Reporting Enabled
Do not display links to any Microsoft provided 'more information' web sites. Enabled
Do not collect additional files Disabled
Do not collect additional machine data Disabled
Force queue mode for application errors Disabled
Corporate upload file path:
Replace instances of the word 'Microsoft' with:
Policy Setting
Display Error Notification Disabled
System/Error Reporting/Advanced Error Reporting settings
Policy Setting
Default application reporting settings Enabled
Default: Report all application errors
Report all errors in Microsoft applications. Enabled
Report all errors in Windows components. Enabled
Policy Setting
Report operating system errors Enabled
System/Group Policy
Policy Setting
Disallow Interactive Users from generating Resultant Set of Policy data Disabled
Group Policy refresh interval for computers Enabled
This setting allows you to customize how often Group Policy is applied
to computers. The range is 0 to 64800 minutes (45 days).
Minutes: 90
This is a random time added to the refresh interval to prevent
all clients from requesting Group Policy at the same time.
The range is 0 to 1440 minutes (24 hours)
Minutes: 30
Policy Setting
Group Policy refresh interval for domain controllers Enabled
This setting allows you to customize how often Group Policy is applied
to domain controllers. The range is 0 to 64800 minutes (45 days).
Minutes: 5
This is a random time added to the refresh interval to prevent
all clients from requesting Group Policy at the same time.
The range is 0 to 1440 minutes (24 hours)
Minutes: 0
Policy Setting
Remove users ability to invoke machine policy refresh Disabled
Scripts policy processing Enabled
Allow processing across a slow network connection Enabled
Do not apply during periodic background processing Disabled
Process even if the Group Policy objects have not changed Disabled
Policy Setting
Security policy processing Enabled
Do not apply during periodic background processing Disabled
Process even if the Group Policy objects have not changed Enabled
Policy Setting
Turn off background refresh of Group Policy Disabled
Turn off Resultant Set of Policy logging Disabled
System/Logon
Policy Setting
Always use classic logon Enabled
Don't display the Getting Started welcome screen at logon Enabled
System/Remote Assistance
Policy Setting
Offer Remote Assistance Disabled
Solicited Remote Assistance Disabled
System/Scripts
Policy Setting
Maximum wait time for Group Policy scripts Enabled
Seconds: 600
Range is 0 to 32000, use 0 for infinite wait time
Policy Setting
Run startup scripts asynchronously Enabled
System/Windows Time Service
Policy Setting
Global Configuration Settings Enabled
Clock Discipline Parameters
FrequencyCorrectRate 4
HoldPeriod 5
LargePhaseOffset 1280000
MaxAllowedPhaseOffset 300
MaxNegPhaseCorrection 54000
MaxPosPhaseCorrection 54000
PhaseCorrectRate 1
PollAdjustFactor 5
SpikeWatchPeriod 90
UpdateInterval 30000
General Parameters
AnnounceFlags 10
EventLogFlags 2
LocalClockDispersion 10
MaxPollInterval 15
MinPollInterval 10
System/Windows Time Service/Time Providers
Policy Setting
Configure Windows NTP Client Enabled
NtpServer pool.ntp.org,0x1
Type NTP
CrossSiteSyncFlags 2
ResolvePeerBackoffMinutes 15
ResolvePeerBackoffMaxTimes 7
SpecialPollInterval 3600
EventLogFlags 0
Policy Setting
Enable Windows NTP Client Enabled
Enable Windows NTP Server Enabled
Windows Components/Internet Explorer
Policy Setting
Add a specific list of search providers to the user's search provider list Enabled
Disable changing Automatic Configuration settings Enabled
Disable changing proxy settings Disabled
Disable Periodic Check for Internet Explorer software updates Enabled
Disable showing the splash screen Enabled
Disable software update shell notifications on program launch Enabled
Prevent participation in the Customer Experience Improvement Program Enabled
Prevent performance of First Run Customize settings Enabled
Select your choice Go directly to home page
Policy Setting
Restrict search providers to a specific list of providers Enabled
Turn off Managing Phishing filter Enabled
Select phishing filter mode Automatic
Windows Components/NetMeeting
Policy Setting
Disable remote Desktop Sharing Enabled
Windows Components/RSS Feeds
Policy Setting
Turn off the feed list Enabled
Windows Components/Terminal Services
Policy Setting
Enforce Removal of Remote Desktop Wallpaper Enabled
Windows Components/Terminal Services/Client/Server data redirection
Policy Setting
Allow audio redirection Enabled
Do not allow client printer redirection Enabled
Do not allow COM port redirection Enabled
Do not allow drive redirection Enabled
Do not allow LPT port redirection Enabled
Do not set default client printer to be default printer in a session Enabled
Windows Components/Terminal Services/Encryption and Security/RPC Security Policy
Policy Setting
Secure Server (Require Security) Enabled
Windows Components/Terminal Services/Sessions
Policy Setting
Set time limit for disconnected sessions Enabled
End a disconnected session 2 days
Policy Setting
Sets a time limit for active but idle Terminal Services sessions Enabled
Idle session limit: 2 days
Policy Setting
Sets a time limit for active Terminal Services sessions Enabled
Active session limit : 2 days
Windows Components/Windows Messenger
Policy Setting
Do not allow Windows Messenger to be run Enabled
Do not automatically start Windows Messenger initially Enabled
User Configuration (Enabled)
Windows Settings
Internet Explorer Maintenance
Browser User Interface/Customized Title Bar
Title Bar Text
Microsoft

 

[509322]

There is 2 kind of approach to security:

1- learn and learn and learn (as i did) then use "advanced" products to lock my system. This is the IT approach using specific "corporate" tools/products.
2- do nothing and expecting an "all-knowing" ultimate product that will keep them safe whatever dumb action they do. This is the home user approach using hyped software then complain how it couldn't prevent the infection.

Guess what? n°1 will probably rarely get infected...

The prevailing industry argument is that users don't understand nor do they want to understand. So, for us to make money, we will give users what they want by catering to their ignorance, and just accept that we cannot meet their unrealistic protection expectations. Unfortunately, that is reality.

The industry has proclaimed "AV is Dead !" repeatedly over decades, but the industry keeps making them and people keep buying them. What and how much does that tell you ?

 

[509322]

Businesses don't need solutions like Appguard which is why *I* think it's dead in the water in the corporate/enterprise world and probably BETTER suited as a consumer application. (no offense) Almost all of what Appguard does can be accomplished with GP, AD control and Limited User Accounts. I know this because it's how we lock down critical systems. Enforcement of GP's to the extent that even programs and features is unavailable. Blocking registry editing, MSI installers, everything else, all right there in AD enforced GP's. Install the software required for minimum business operation then push the GP out and presto. Done deal. Why would a third party tool be needed?

The only home users that utilize default-deny solutions are predominantly security soft geeks. There's no money in the home user market. It is why AppGuard never actively pursued that market.

Most IT Pros I know don't use, nor want to use, Windows' GPO, AppLocker, Applcation Control, etc for a variety of legit reason - but mostly because of no documentation and using it all is a really big rigmarole. If everybody in the commercial space used native Windows security then there would be no market for SRP\Whitelisting or other 3rd-party programs in the commercial space. However, there is a definite market for non-native Windows security solutions, including SRP, and organizations are buying.

People and enterprises should use what they like. What works best for them. And for a lot of people and organizations, real-world practical experience and testing over decades has proven that native Windows security ain't it for a lot of different valid reasons. That's why there is a multi-billion dollar 3rd-party security industry. It is so wildly successful because it caters to solving all the problems people face with Windows native security.

 

[artek]

It's sort of a knowledge death spiral that keeps AV alive. You need something to tell an unsophisticated user that a file, script, whatever, is bad. When a user reaches the point where they're smart enough to deploy and configure something more advanced like a hips program, they no longer need it.

 

[509322]

It's sort of a knowledge death spiral that keeps AV alive. You need something to tell an unsophisticated user that a file, script, whatever, is bad. When a user reaches the point where they're smart enough to deploy and configure something more advanced like a hips program, they no longer need it.

Those that know don't need it. Those that need it can't handle it.

I see a surprisingly high number of people who cannot manage Windows at - what most people here - would consider a basic level. And those users have college degrees. Some have advanced degrees.

 

[artek]

Those that know don't need it. Those that need it can't handle it.

Exactly. Part of it is that the cost of exploiting a fully up to date home-user has risen in a fairly steady rate with security innovations in Chrome, Windows, etc., to the point where the payoff isn't necessarily worth the cost of the exploit used. That's not to say it doesn't happen. But you can stay secure and uninfected now with nothing but an up-to-date OS and an adblocker, and that wasn't necessarily true during the earlier days of windows.

 

[Kubla]

Let's say Ai progresses to a very high level within the security soft industry. The bad news (there is always a realist side to things) is:

Malc0ders and other malicious actors are just going to turn Ai against the industry and to their great advantage. Just like they have done with just about everything else. Not all malc0ders and malicious actors are poor and unsophisticated... scraping by on the Dark Web. Some have considerable assets such that they can leverage Ai. In fact, they more than likely been have been exploring or using Ai\ML for years.

Things change within the security soft industry, but the cat-and-mouse struggle between the malc0ders and the security soft industry have remained consistently the same for decades. And the malicious actors have always come out on-top against default-allow solutions.

Some are even government backed with virtually unlimited resources, the Russians are mostly focused on political, military and industrial espionage malware hacking the Chinese will get into anything they can even Grandmas old Apple IIE given the chance.

 

[rsonic]

Some are even government backed with virtually unlimited resources, the Russians are mostly focused on political, military and industrial espionage malware hacking the Chinese will get into anything they can even Grandmas old Apple IIE given the chance.

Well.... Yeah.... But if the US Army for some reason decides it wants to invade my house there's not much I could do about it, for example. I don't consider it a fair way of planning security.

 

[509322]

Exactly. Part of it is that the cost of exploiting a fully up to date home-user has risen in a fairly steady rate with security innovations in Chrome, Windows, etc., to the point where the payoff isn't necessarily worth the cost of the exploit used. That's not to say it doesn't happen. But you can stay secure and uninfected now with nothing but a secure OS and an adblocker, and that wasn't necessarily true during the earlier days of windows.

There's a lot of different perspectives.

The threat remains obsolete software and hardware, unpatched systems, and poor security practices. And security all goes back to people. Within the context here, t is purely a human concept and set of behaviors. There is no such thing as security in the natural world in the sense that humans utilize it. I am talking about stuff way above the herd sticking together to protect itself from the wolf.

On the forums the focus is all on personal system security. A well-protected home system isn't going to matter one bit if your bank is hacked or your identity is stolen and fraudulently used to create lines of credit. Some will argue that don't happen often. Oh no ? It don't ? Read the IT security news. And what do you say to the people who lost all their money or financially raped - even though their relative number is tiny ?

The forums are predisposed to focus on the paranoid side of things. And that is fine when an increased level of wariness and vigilance keeps you safe. The problem is when people blow stuff way out of proportion or interpret stuff and make it out to be what they wish it to be or get all bent out of shape about these philosophical discussions... as if they are product bashing.

Whatever... within months, if not weeks, the hive will have moved onto something other than this discussion. And people will be using and promoting something other than Cylance.

 

[artek]

There's a lot of different perspectives.

The threat remains obsolete software and hardware, unpatched systems, and poor security practices. And security all goes back to people. It is purely a human concept and set of behaviors. There is no such thing as security in the natural world.

On the forums the focus is all on personal system security. A well-protected home system isn't going to matter one bit if your bank is hacked or your identity is stolen and fraudulently used to create lines of credit. Some will argue that don't happen often. Oh no ? It don't ? Read the IT security news. And what do you say to the people who lost all their money or financially raped - even though their relative number is tiny ?

The forums are predisposed to focus on the paranoid side of things. And that is fine when an increased level of wariness and vigilance keeps you safe. The problem is when people make claims that are blown way out of proportion or interpret stuff and make it out to be what they wish it to be or get all bent out of shape about these philosophical discussions... as if they are product bashing.

I would add to that last bit, when they take vendor marketing claims too literally.

 

[509322]

I would add to that last bit, when they take vendor marketing claims too literally.

It's the reason why marketing is so effective.

I am a big critic of marketing generally, including our own. But marketing is marketing. And like everything else man-made in this world, nothing is perfect.

 

[ForgottenSeer 58943]

Exactly. Part of it is that the cost of exploiting a fully up to date home-user has risen in a fairly steady rate with security innovations in Chrome, Windows, etc., to the point where the payoff isn't necessarily worth the cost of the exploit used.

This is an important point. It's not fully possible to secure a rather large corporation with some best practices to the point where no true infection will occur under 99% of situations. Proper, secured GP on the endpoints (no SRP needed), Trend Micro Worry Free Advanced, w/non-default, tweaked settings and ML enabled. Trend Micro HES w/BEC AI/ML Enabled + non-Default and additional attachment categories. A competent, high quadrant properly configured UTM/NGFW. NO BYOD on internal subnets. VLAN segregation. VPN for remote users. Keep everything up to date, and you won't have a single issue other than a few random PUA's or bad browser extensions each year in a 5,000 user corporation. This is why Cylance performs so well under enterprise conditions - most enterprises using Cylance utilize best practice, and any firm that would likely consider Cylance already considers security as a very important thing. Those scripts Cylance has trouble with won't even arrive in most cases, and won't execute in all cases. The cost of infiltrating such a firm has become prohibitive to the vast majority of threat actors.

On to Artek's point for home users. All of this is filtering down to home users. Those UTM's on the network for home users (Gryphon, ASUS w/AiProt, F-Secure Sense, Bit Defender Box, Norton Sphere, Cujo, etc...) are responsible for rapid and heavy security improvements. Add in what Artek points out - Chrome, Secure/Filtering DNS, Win10, things are getting tough. Just tossing Cylance into the mix on such an endpoint is going to present near insurmountable odds for anyone but the most targeted attack from knocking you out.

While malware numbers increase, we're not seeing infection rates lining up with the curve. In fact infection rates have been - overall - considering user increases, dropping. I wouldn't become an investor in traditional antivirus solutions unless I was a gambler prepared for a loss.

 

[509322]

This is an important point. It's not fully possible to secure a rather large corporation with some best practices to the point where no true infection will occur under 99% of situations. Proper, secured GP on the endpoints (no SRP needed), Trend Micro Worry Free Advanced, w/non-default, tweaked settings and ML enabled. Trend Micro HES w/BEC AI/ML Enabled + non-Default and additional attachment categories. A competent, high quadrant properly configured UTM/NGFW. NO BYOD on internal subnets. VLAN segregation. VPN for remote users. Keep everything up to date, and you won't have a single issue other than a few random PUA's or bad browser extensions each year in a 5,000 user corporation. This is why Cylance performs so well under enterprise conditions - most enterprises using Cylance utilize best practice, and any firm that would likely consider Cylance already considers security as a very important thing. Those scripts Cylance has trouble with won't even arrive in most cases, and won't execute in all cases. The cost of infiltrating such a firm has become prohibitive to the vast majority of threat actors.

On to Artek's point for home users. All of this is filtering down to home users. Those UTM's on the network for home users (Gryphon, ASUS w/AiProt, F-Secure Sense, Bit Defender Box, Norton Sphere, Cujo, etc...) are responsible for rapid and heavy security improvements. Add in what Artek points out - Chrome, Secure/Filtering DNS, Win10, things are getting tough. Just tossing Cylance into the mix on such an endpoint is going to present near insurmountable odds for anyone but the most targeted attack from knocking you out.

While malware numbers increase, we're not seeing infection rates lining up with the curve. In fact infection rates have been - overall - considering user increases, dropping. I wouldn't become an investor in traditional antivirus solutions unless I was a gambler prepared for a loss.

The vast majority of companies do not put that much effort into their IT security. What you describe represents only a small percentage of the overall enterprise\commerical space. The vast majority of companies in the world (small-medium business) have an insufficient IT security budget along with an understaffed, if non-existent, IT security department.

Where do you get your statistics ?

Net infection rates have been on the increase. That has been the trend for years. Digital theft is at its highest levels ever. And industry analysts and IT security insider polls forecast the rate to increase for decades to come. Most of that is due to the fact that over half the world is still on obsolete, unpatched systems with poor security practices - including a significant proportion of enterprises. And this is despite users having security solutions installed - and somewhere in those statistics it includes security solutions of all types, including Cylance.

I agree that with IT security departments that rank in the top 3 % or higher, what you describe is accurate. And surprisingly, the top 3 % is not all Fortune 500 or 250 companies. A lot of huge companies have slovenly IT security.

 

[AtlBo]

Those UTM's on the network for home users (Gryphon, ASUS w/AiProt, F-Secure Sense, Bit Defender Box, Norton Sphere, Cujo, etc...) are responsible for rapid and heavy security improvements. Add in what Artek points out - Chrome, Secure/Filtering DNS, Win10, things are getting tough. Just tossing Cylance into the mix on such an endpoint is going to present near insurmountable odds for anyone but the most targeted attack from knocking you out.

This is great thanks. Where did improvements in the past arise? With bold new ideas in enterprise that filtered down to home users in a package that is more manageable for their purposes.

For me, trends are everything in business and also the key to reading change. Cylance has something that can be useful in a certain context by the sound of it, and, if that is the case, then the developments there will filter into the trends for what's next. In that light, of all the comments here, I most appreciate @ForgottenSeer 58943's contextual analysis of his early impressions of Cylance. THAT has helped us all place a proper perspective and expectations on the software...even new and inexperienced users. Even got a test out of the deal !

Now more than ever, based on the emerging technologies, I am sensing the beginning of the end for malware on personal use PCs at home and also standard workstations at the office. too (I tend to agree with @ForgottenSeer 58943 on this). "It's not worth it" is exactly what we want to be hearing from hackers. All said though, it's true imo that anyone who says that the bigger job will be systemizing security and secure practices into everyday routine is onto the future for internet and personal/financial and enterprise security.

 

[simmerskool]

Can you login to your console with your smart phone like you do with your pc?

yes

 

[ForgottenSeer 58943]

The vast majority of companies do not put that much effort into their IT security. What you describe represents only a small percentage of the overall enterprise\commerical space. The vast majority of companies in the world (small-medium business) have an insufficient IT security budget along with an understaffed, if non-existent, IT security department.

This number is growing, but still small - I agree. However the movement out of on-prem solutions to cloud based/hosted solutions is dramatically increasing security and reducing threat surfaces in organizations. I don't think people fully grasp how vulnerable an on-prem SBS/Exchange server is compared to Hosted 365. I don't think people realize how incredibly vulnerable on-prem Quickbooks, Sage and File Servers are compared to hosted offerings. As the shift continues from on-prem to hosted, security is also improving. Also this security increase is driven by firms that aren't willing to risk their systems to access by shoddy firms. We've seen accounting firms moving to hosted solutions that require a clean, audited endpoint to be connected to those solutions which then apply additional security filters on the host serves.

Another big area of change is on-site IT staff being shifted over to MSP's. The growth in that area is phenomenal.. You can pay a qualified MSP that uses all best practices for a mere $30 a device and avoid all of the costs associated with retaining an on-site IT department and the pitfalls all of that brings. Behind those MSP's are often legions of certified, qualified, trained, experienced engineers and security teams. Even more, MSP's enforce best practice deployment and management because the liability for an outbreak or compromise gets shifted to the MSP.

These two things are driving a new paradigm in IT, and they are accelerating with each passing month.

Now more than ever, based on the emerging technologies, I am sensing the beginning of the end for malware on personal use PCs

It's worse than people realize for malware coders. They're a dying breed. It's not just the fact that 72% of EDU have moved to Chromebooks, the MSP's, or the Cloud/Hosted movement..

We must remember an important thing in all of this.. Especially for the NoObs that get all in a panic when CS releases a video bypassing XYZ security or showing flaws in this or that product. It's quite obvious Cruel Sisters cat is capable of coding some very advanced malware, or altering existing malware to bypass many security products. It's another for Cruel Sister to 'deliver' that payload onto a remote system. It simply won't happen. I could give Cruel Sister my WAN IP and be completely safe and comfortable with the knowledge that there isn't a single thing she can do to deliver and execute her custom payload onto my endpoints.

When people get all bound up over a youtube video showing this or that bypassed or this or that being executed, they need to understand that in the framework of reality, it simply won't happen as there is no delivery mechanism for it and the chances of seeing it are zero. This is like those Lockpicking youtube videos where they bypass my Bi-Lock's. After pulling the shroud off, opening up and examining the dips, then putting it back together, tossing it in a vice and spending 11 days trying to pick it with tools designed specifically to attempt this. It's total fantasy, all of it.

As for Cylance - back on that topic. Toss it on a box w/Syshardener(and/or OSA)+a URL scanning extension or filtering DNS. Or Syshardener(and or OSA)+Heimdal, and any old TP-Link router laying around and you are good to go with zero system impact. Ain't nothing going to knock you out. If you are paranoid (or cautious) toss a Gryphon/Untangle/ASUS w/AiProt/Fortinet on the gateway and ramp it up to levels where you can really just walk away from any security theater entirely.

PS: More people have Cylance right now around these parts. Maybe someone will take the torch up and put it with Syshardener/OSA and/or +Heimdal like I said and prove my point. (or disprove possibly) The offer still stands.

 

[ForgottenSeer 69673]

yes

I was wondering if you could and if so can you change settings that way with your phone?