Reply to thread

Message

<blockquote data-quote="danb" data-source="post: 1059486" data-attributes="member: 62850">I certainly appreciate your enthusiasm for cybersecurity, and I think you have done an amazing job describing several aspects of Windows Security that many people do not spend the time or effort to understand.&nbsp; I also agree with you on the marketing aspect, but please keep in mind that when other people read your verbiage (as well as CyberLocks), they have the same reaction.&nbsp; You and I use particular verbiage because we believe it to be true, but other people might not see it that way.A kernel mode driver will provide a developer all the access they need to properly protect a computer.&nbsp; Even MD uses a kernel mode driver.&nbsp; I think what you are trying to exemplify is that, for example, many users have requested a version of VS / CL for Android and Apple.&nbsp; But since we do not have access to the kernel, we are not able to build a version of our software for their platform.I have read through your material several times, and I could be wrong about WDAC, so I created a new thread so we can intelligently and civilly discuss this further...[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/wdac-vs-kernel-mode-drivers.126141/#post-1059485[/URL]As far as SAC is concerned, here is Microsoft&#039;s description...[URL unfurl=&quot;true&quot;]https://support.microsoft.com/en-gb/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003[/URL]I am sorry, but that is not deny-by-default / zero-trust.&nbsp; Auto allowing by digital signature alone is dangerous and lazy.As far as WDAC is concerned...WDAC without ISG is unusable.&nbsp; WDAC with ISG is not true deny-by-default / zero-trust.Edit:&nbsp; I forgot to mention that I have a list of 19,000+ files / hashes from the WhitelistCloud database that are likely malware and will likely bypass SmartScreen, SAC and ISG.</blockquote>

[QUOTE="danb, post: 1059486, member: 62850"] I certainly appreciate your enthusiasm for cybersecurity, and I think you have done an amazing job describing several aspects of Windows Security that many people do not spend the time or effort to understand. I also agree with you on the marketing aspect, but please keep in mind that when other people read your verbiage (as well as CyberLocks), they have the same reaction. You and I use particular verbiage because we believe it to be true, but other people might not see it that way. A kernel mode driver will provide a developer all the access they need to properly protect a computer. Even MD uses a kernel mode driver. I think what you are trying to exemplify is that, for example, many users have requested a version of VS / CL for Android and Apple. But since we do not have access to the kernel, we are not able to build a version of our software for their platform. I have read through your material several times, and I could be wrong about WDAC, so I created a new thread so we can intelligently and civilly discuss this further... [URL unfurl="true"]https://malwaretips.com/threads/wdac-vs-kernel-mode-drivers.126141/#post-1059485[/URL] As far as SAC is concerned, here is Microsoft's description... [URL unfurl="true"]https://support.microsoft.com/en-gb/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003[/URL] I am sorry, but that is not deny-by-default / zero-trust. Auto allowing by digital signature alone is dangerous and lazy. As far as WDAC is concerned... WDAC without ISG is unusable. WDAC with ISG is not true deny-by-default / zero-trust. Edit: I forgot to mention that I have a list of 19,000+ files / hashes from the WhitelistCloud database that are likely malware and will likely bypass SmartScreen, SAC and ISG. [/QUOTE]

Verification