Reply to thread

Message

<blockquote data-quote="93803123" data-source="post: 834355">The only way to assuredly protect against fileless malware is to block file types and the underlying interpreters on a full-time basis. Sometimes, even libraries (DLLs) need to be blocked. These steps cover both disk and memory, not to mention the vast majority of exploits. Anti-exectuables that allow something to launch and then hold it in a suspended state are susceptible to bypasses. And AV, behavioral monitoring and sandboxing have all proven to fail in corner cases. Coders cannot foresee everything that is possible. So they deserve a reasonable amount of understanding. A good best-effort is good enough. Unreasonable expectations are not acceptable.That&#039;s not to say one is much better than the other. The determinate is how paranoid the user is. If they want the highest security, then they use SRP. If they want usability with high security, then they use one of the more popular security software. Afterall, in the end we are sometimes talking about differences as small as 0.2 or 0.1 %. It&#039;s pointless to argue over such tiny, practically meaningless differences.Here at engineering user lab, SRP always works best. But whatever, you have a lot of solid options available to you.</blockquote>

[QUOTE="93803123, post: 834355"] The only way to assuredly protect against fileless malware is to block file types and the underlying interpreters on a full-time basis. Sometimes, even libraries (DLLs) need to be blocked. These steps cover both disk and memory, not to mention the vast majority of exploits. Anti-exectuables that allow something to launch and then hold it in a suspended state are susceptible to bypasses. And AV, behavioral monitoring and sandboxing have all proven to fail in corner cases. Coders cannot foresee everything that is possible. So they deserve a reasonable amount of understanding. A good best-effort is good enough. Unreasonable expectations are not acceptable. That's not to say one is much better than the other. The determinate is how paranoid the user is. If they want the highest security, then they use SRP. If they want usability with high security, then they use one of the more popular security software. Afterall, in the end we are sometimes talking about differences as small as 0.2 or 0.1 %. It's pointless to argue over such tiny, practically meaningless differences. Here at engineering user lab, SRP always works best. But whatever, you have a lot of solid options available to you. [/QUOTE]

Verification