ReHIPs is a great program, and definitely one of my favorites, but it does not have a fully developed HIPS like SpyShelter and COMODO and the others do. The HIPS is pretty rudimentary, because the main strength of the software lies in its isolation capabilities.
I think there should be more creativity in the rules creations dialogs of HIPS programs for one thing. User needs to be able to see his choice of protections and maybe even associated them with a color or zone or something. There is some effort for this in security programs, but not anywhere nearly as much as I would like. User should be able to have a visual map at all times in his/her head of how the protection engages and its scope, especially with HIPS. Not just this, though. In some cases, it could be important to know when/where there isn't protection too. Visualization is nice.
Practicing with HIPS involves setting them to "Interactive" mode - which is basically where the HIPS generates an alert for many actions on the system.
After using Private Firewall, I am curious if HIPS could help users maybe by presenting what has been approved by the user for the application already, both number of rules allowed and then maybe what was the last rule and when the last rule was allowed. It's easy with HIPS to get lost in a sea of rules, because the rules can be set for all processes. Well, the context of seeing my own choices so far as a user for a process I think would help bring home the decision for me. It would be in the proper context of all that has happened before. Maybe there more interesting uses for counters that could be applied to HIPS...just don't know, but HIPS can use some of this kind of thing I think. In this way, security HIPS alerts could show me somehow that the process does business in dangerous neighborhoods and give a risk assessment concerning what could go wrong.
Just to remind myself
, standard HIPS does nothing to block the worst kind of subversive malware...the kind for stealing data and ideas. There should be connection HIPS of some sort too. Rules are pretty limited in the programs I have seen. Something like alert me if any of x, y, or z data is scheduled to be moved over the internet.
But a problem arises when the user installs a new and unfamiliar app. There, you can't rely on the HIPS prompts to tell you when it's getting malicous. It's almost impossible to know that, during the installation process.
For the short term at least, why can't changes to known user file types (or even user defined types of files) be alerted every time for safety sake. And then if there is a drive by and the user accidently allows one, on the next file, he gets a second chance to stop ransomeware.
Or another concept that might work for protecting personal files would be to do a test write to a virtual environment with each change to amass a list of changes to the first file. Present the nature of the changes in an alert to the user before user allows/denies the save and then the next choice comes. In this case, even the first file could be protected from ransomeware. User could then be presented an option of whether to whitelist remaining batch changes scheduled by the process or not. I don't think I would put this on the same prompt as the initial process allow block alert, because malware writers would surely go to writing normally with the first file and then beginning the malicious activity. Something else to remember and consider I think.
The ransomeware problem is like a train without brakes that is nearing each one of us. We need to find some brakes for systems to at least slow the train enough so that it does very minimal or no damage.
I use SpyShelter on two test systems along with AppGuard - not so much for protection but instead to study process run sequences and to capture command lines. It's just convenient for me.
Interesting job. Thanks for the helpful comments.
