Reply to thread

Message

<blockquote data-quote="danb" data-source="post: 1059527" data-attributes="member: 62850">The file is executed and a lot of data is extracted and evaluated.&nbsp; I hope to be able to do this with ISG as well soon, and then compare the SmartScreen results.MS Defender is disabled during the tests (as it is in almost all malware tests), so I have no idea if MD would have blocked the malware or not, since that was not the focus of the analysis.My only point is that a lot of people consider WDAC + ISG to be deny-by-default / zero-trust, when it actually is not.&nbsp; In other words, one cannot cobble together 3-4 relatively effective security layers, and honestly claim that it is true zero-trust.&nbsp; In order to be true zero-trust, there needs to be a single monolithic blocking mechanism that blocks everything that needs to be blocked.&nbsp; It is nice to have extra layers as an added precaution, but the main blocking mechanism should not be easily bypassable for the same attack vector if the samples change slightly.</blockquote>

[QUOTE="danb, post: 1059527, member: 62850"] The file is executed and a lot of data is extracted and evaluated. I hope to be able to do this with ISG as well soon, and then compare the SmartScreen results. MS Defender is disabled during the tests (as it is in almost all malware tests), so I have no idea if MD would have blocked the malware or not, since that was not the focus of the analysis. My only point is that a lot of people consider WDAC + ISG to be deny-by-default / zero-trust, when it actually is not. In other words, one cannot cobble together 3-4 relatively effective security layers, and honestly claim that it is true zero-trust. In order to be true zero-trust, there needs to be a single monolithic blocking mechanism that blocks everything that needs to be blocked. It is nice to have extra layers as an added precaution, but the main blocking mechanism should not be easily bypassable for the same attack vector if the samples change slightly. [/QUOTE]

Verification