Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1059606" data-attributes="member: 32260">I think that ISG or WLC / VoodooAi are sufficient when the home users browse the web or check email.Such activities are well-tested by AV_Test, AV_Comparatives, and SE Labs.For example, Microsoft Defender on default settings can miss approximately one malware per 250 samples.When you add WDAC (ISG), WLC / VoodooAi, or even SAC, the chances are probably one infection per several thousand samples. Most users can see (at maximum) a few malware per year, so they should not worry about the infection, except when one would like to be Matuzalem. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />A different situation is in enterprises when the machine can likely work in a compromised environment, and the attacker can know the details of the implemented security. WDAC can be configured with Hypervisor-protected Code Integrity, and the policies can be signed. Such protection is much more resistant to attacks via kernel compared to any security based on kernel driver.</blockquote>

[QUOTE="Andy Ful, post: 1059606, member: 32260"] I think that ISG or WLC / VoodooAi are sufficient when the home users browse the web or check email. Such activities are well-tested by AV_Test, AV_Comparatives, and SE Labs. For example, Microsoft Defender on default settings can miss approximately one malware per 250 samples. When you add WDAC (ISG), WLC / VoodooAi, or even SAC, the chances are probably one infection per several thousand samples. Most users can see (at maximum) a few malware per year, so they should not worry about the infection, except when one would like to be Matuzalem. :) A different situation is in enterprises when the machine can likely work in a compromised environment, and the attacker can know the details of the implemented security. WDAC can be configured with Hypervisor-protected Code Integrity, and the policies can be signed. Such protection is much more resistant to attacks via kernel compared to any security based on kernel driver. [/QUOTE]

Verification