Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 956309" data-attributes="member: 32260">The explanation is already well known.&nbsp; The older SRP solutions (classic SRP and Applocker) are not considered a security boundary - Microsoft suggests using WDAC for that. This follows from the fact that in Enterprises the properly configured WDAC can better protect against malicious drivers and attacks related to Windows kernel.In Enterprises the classic SRP and Applocker are used for other purposes like for example:[URL unfurl=&quot;true&quot;]https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview[/URL]So, the purpose is to restrict users from running/opening unwanted/malicious executables or other unsafe files. I would say that it is a kind of reducing the attack surface via software whitelisting methods. Microsoft found out also that attack surface reduction can be done with the help of the cloud and some exploit mitigations - so we have Defender ASR rules, CFA, and Exploit Protection mitigations.</blockquote>

[QUOTE="Andy Ful, post: 956309, member: 32260"] The explanation is already well known. The older SRP solutions (classic SRP and Applocker) are not considered a security boundary - Microsoft suggests using WDAC for that. This follows from the fact that in Enterprises the properly configured WDAC can better protect against malicious drivers and attacks related to Windows kernel. In Enterprises the classic SRP and Applocker are used for other purposes like for example: [URL unfurl="true"]https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview[/URL] So, the purpose is to restrict users from running/opening unwanted/malicious executables or other unsafe files. I would say that it is a kind of reducing the attack surface via software whitelisting methods. Microsoft found out also that attack surface reduction can be done with the help of the cloud and some exploit mitigations - so we have Defender ASR rules, CFA, and Exploit Protection mitigations. [/QUOTE]

Verification