Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 890496" data-attributes="member: 32260">Not exactly. The H_C can block in the home environment also the second scenario via blocking the .chm Sponsor hh.exe. The difference between SRP settings in H_C and for example Excubits driver (Bouncer) is that the second can block also processes started with Admin rights. In the enterprise environment, malware can exploit unpatched vulnerabilities (privilege escalation) or attack the computer from the local network with high privileges.I could implement SRP also for Admin processes, but this would be probably risky in the home environment with default-deny settings and much less useful than in the enterprise environment. For this reason, Bouncer driver has also the option to block only standard processes.In enterprises, Administrators can delay updates for a long time so they can use the security which can block Admin processes. If they plan to update something, then they simply can turn off the security. That is not possible in the home environment on Windows 10 (especially on the computers of inexperienced users, when these computers are maintained occasionally by an advanced user).Look at the H_C right panel options + FirewallHardening (also WD advanced options if WD real-time protections is ON + DocumentsAntiExploit tool if required).<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /></blockquote>

[QUOTE="Andy Ful, post: 890496, member: 32260"] Not exactly. The H_C can block in the home environment also the second scenario via blocking the .chm Sponsor hh.exe. The difference between SRP settings in H_C and for example Excubits driver (Bouncer) is that the second can block also processes started with Admin rights. In the enterprise environment, malware can exploit unpatched vulnerabilities (privilege escalation) or attack the computer from the local network with high privileges. I could implement SRP also for Admin processes, but this would be probably risky in the home environment with default-deny settings and much less useful than in the enterprise environment. For this reason, Bouncer driver has also the option to block only standard processes. In enterprises, [B]Administrators can delay updates for a long time[/B] so they can use the security which can block Admin processes. If they plan to update something, then they simply can turn off the security. That is not possible in the home environment on Windows 10 (especially on the computers of inexperienced users, when these computers are maintained occasionally by an advanced user). Look at the H_C right panel options + FirewallHardening (also WD advanced options if WD real-time protections is ON + DocumentsAntiExploit tool if required).:) [/QUOTE]

Verification