Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 896217" data-attributes="member: 32260">Do not insist, please. The idea of H_C is not using 3rd party drivers, not using 3rd party real-time protection, and disappear from the system after initial configuration. Introducing any 3rd party driver will make the H_C another type of application. It will become not a configurator but real-time security related application. If I have to use 3rd party driver then it should do much more than protecting SRP Registry keys, that are already protected by Windows integrity levels.I wrote this a year or two ago. Worrying about changing SRP Registry keys by malware (with H_C settings) would be like worrying that the coffin will be too small for you, after your death. The H_C is made to keep you alive, and is useless as an after life feature.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />Edit.Protecting the SRP settings would be more justified in Enterprises, where SRP is often configured to block also elevated processes. Such additional protection is welcome due to much bigger attack surface area (not patched systems and applications). Microsoft solved this by introducing Applocker (and later WD Application Control) which uses kernel driver.</blockquote>

[QUOTE="Andy Ful, post: 896217, member: 32260"] Do not insist, please. The idea of H_C is not using 3rd party drivers, not using 3rd party real-time protection, and disappear from the system after initial configuration. Introducing any 3rd party driver will make the H_C another type of application. It will become not a configurator but real-time security related application. If I have to use 3rd party driver then it should do much more than protecting SRP Registry keys, that are already protected by Windows integrity levels. I wrote this a year or two ago. Worrying about changing SRP Registry keys by malware (with H_C settings) would be like worrying that the coffin will be too small for you, after your death. The H_C is made to keep you alive, and is useless as an after life feature.:) Edit. Protecting the SRP settings would be more justified in Enterprises, where SRP is often configured to block also elevated processes. Such additional protection is welcome due to much bigger attack surface area (not patched systems and applications). Microsoft solved this by introducing Applocker (and later WD Application Control) which uses kernel driver. [/QUOTE]

Verification