Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 968849" data-attributes="member: 32260">The classic SRP can be still very useful to prevent the malware started by the user on the uninfected computer. But it cannot protect well computers in the already infected networks in Enterprises.For example, It cannot fight any malware (on the already infected environment) that uses malicious drivers or malicious .NET DLLs.Even AppLocker is not sufficient to protect against some modern attack vectors. According to Microsoft, the security boundary that can support/replace SRP and Applocker is Microsoft Defender Application Control. Of course, even if one uses SRP + AppLocker + MDAC, this is still not bulletproof protection in Enterprises. The recommended security strategy in Enterprises is using Microsoft Defender + MDAC with &quot;Zero Trust&quot; security model. Of course, there are several paid versions of Defender with different capabilities.</blockquote>

[QUOTE="Andy Ful, post: 968849, member: 32260"] The classic SRP can be still very useful to prevent the malware started by the user on the uninfected computer. But it cannot protect well computers [B]in the already infected networks in Enterprises[/B]. For example, It cannot fight any malware (on the already infected environment) that uses malicious drivers or malicious .NET DLLs. Even AppLocker is not sufficient to protect against some modern attack vectors. According to Microsoft, the security boundary that can support/replace SRP and Applocker is Microsoft Defender Application Control. Of course, even if one uses SRP + AppLocker + MDAC, this is still not bulletproof protection in Enterprises. The recommended security strategy in Enterprises is using Microsoft Defender + MDAC with "Zero Trust" security model. Of course, there are several paid versions of Defender with different capabilities. [/QUOTE]

Verification