Is there an anti-executable / application whitelisting component in CIS?

[Spiritus Sancti]

I really want to secure my PC with anti-executable / application whitelisting technique.

Is there such a component in CIS?

 

[yigido]

Use proactive configuration and go to sandbox settings. By default proactive security will virtualize all unknows files.
If you want to block all files but whitelisted files.
See help: https://help.comodo.com/topic-72-1-623-7763-Configuring-Rules-for-Auto-Sandbox.html
Set "Block" for others.. So CIS only allows whitelisted ones, others will blocked.. Protection %100

You can dig into help files to learn more (like me) : https://help.comodo.com/topic-72-1-623-7587-Introduction-to-Comodo-Internet-Security.html

 

[ExoGen CyberSecurity]

By default will sandbox everything (you can configure to make it better).

 

[shmu26]

but do keep in mind that COMODO has thousands of trusted vendors on their list and in their cloud base, and they themselves co-sign a lot of software too, so what you consider "unknown" might be quite different from what COMODO considers "unknown".

 

[yigido]

but do keep in mind that COMODO has thousands of trusted vendors on their list and in their cloud base, and they themselves co-sign a lot of software too, so what you consider "unknown" might be quite different from what COMODO considers "unknown".

Comodo may sells digital signatures but they do not add them blind-fully!
There are very strict rules for entering to Trusted Vendors List.

 

[hjlbx]

I really want to secure my PC with anti-executable / application whitelisting technique.

Is there such a component in CIS?

Yes.

Two components - HIPS and auto-sandbox.

A. Set auto-sandbox to Block any Unrecognized\Unknown files.

B. Disable "Trust digitally signed files."

* * * * *

For beginner, just do A - and not B.

COMODO can be a challenge for new user - especially if you dive right into all the settings... but you can only learn it by using it... so I suppose you have to start somewhere.

 

[yigido]

Two components - HIPS and auto-sandbox.

A. Set auto-sandbox to Block any Unrecognized\Unknown files.

B. Disable "Trust digitally signed files."

* * * * *

For beginner, just do A - and not B.

COMODO can be a challenge for new user - especially if you dive right into all the settings... but you can only learn it by using it... so I suppose you have to start somewhere.

I am long-time user but I prefer A.
I found it very usefull for me and I did not dig into CIS settings much. I found HIPS useless while sandboxing all unknowns.
I even tested malwares on my real machine and I got 0 infection from the first day. Long live Comodo (default-deny)

 

[shmu26]

Yes.



B. Disable "Trust digitally signed files."

let's say you did B, but you want to whitelist your Windows files. How exactly do you go about whitelisting thousands of exe files?

 

[hjlbx]

let's say you did B, but you want to whitelist your Windows files. How exactly do you go about whitelisting thousands of exe files?

Whitelist entire C:\Windows directory under File Rating > Add to Trusted Vendor list

It is in the CIS Help File, but you just do it for the entire C:\Windows directory instead of a single file

You should do this after every Windows update

You can also do the same for C:\Program Files and C:\Program Files (x86)

You will just have to do it to learn how and the quirks... you will see...

 

[shmu26]

Whitelist entire C:\Windows directory under File Rating > Add to Trusted Vendor list

It is in the CIS Help File, but you just do it for the entire C:\Windows directory instead of a single file

won't that just add microsoft as a trusted vendor?

 

[hjlbx]

won't that just add microsoft as a trusted vendor?

You're whitelisting the files contained in C:\Windows - and not adding Microsoft to the TVL

Any how, Microsoft should be in the TVL

Making an ultra-paranoid config that COMODO did not intend to be used (but can be made by the user in CIS) might cause bad system malfunctions - and in the end you will blame CIS instead of your config for it

 

[Av Gurus]

Yes.

Two components - HIPS and auto-sandbox.

A. Set auto-sandbox to Block any Unrecognized\Unknown files.

B. Disable "Trust digitally signed files."

* * * * *

For beginner, just do A - and not B.

COMODO can be a challenge for new user - especially if you dive right into all the settings... but you can only learn it by using it... so I suppose you have to start somewhere.

Settings for A is this (picture)?

 

[hjlbx]

Settings for A is this (picture)?

View attachment 117790

Yes; correct

 

[Av Gurus]

...and to add C:\Windows, C:\Program Files...to trusted files/folder is here:

 

[hjlbx]

...and to add C:\Windows, C:\Program Files...to trusted files/folder is here:

View attachment 117792

Yes; correct

After you do it, you might\will see that the GUI is slow to load when you go back to File List; I used to see some GUI instability when it had to load a bunch of infos

 

[shmu26]

Making an ultra-paranoid config that COMODO did not intend to be used (but can be made by the user in CIS) might cause bad system malfunctions - and in the end you will blame CIS instead of your config for it

I would turn off autosandbox until I finished whitelisting Windows, as you have previously recommended. But what happens when WIndows pushes a major update? Will the system maybe become unbootable?
what other bad malfunctions should I be prepared to suffer?

 

[hjlbx]

I would turn off autosandbox until I finished whitelisting Windows, as you have previously recommended. But what happens when WIndows pushes a major update? Will the system maybe become unbootable?
what other bad malfunctions should I be prepared to suffer?

Each time Windows Update pushes an update - even a huge one, in reality, relatively few critical Windows files change - meaning the ones you need to load and get into your system.

Besides... if COMODO smash your system to the point where you can't logon - you just F12 - or whatever F-key your system uses - and boot into Safe Mode and whitelist the files while in Safe Mode.

I have never seen it that bad. The worst I have seen is AMD graphics drivers get auto-sandboxed and cause some problems - even a black screen (boot but nothing visible) - but the above is a way to deal with that sort of problem.

This is why it is recommended by experienced MT members that have experience with COMODO, that advanced configuration of COMODO should be undertaken by users that are advanced Windows users before they even put COMODO onto their system.

You can ask @Umbra, @DracusNarcrym , and others that participated in it - about our private COMODO experiment; bottom line is you got to know how to get yourself out of trouble no matter which soft you are using.

 

[shmu26]

Each time Windows Update pushes an update - even a huge one, in reality, relatively few critical Windows files change - meaning the ones you need to load and get into your system.

Besides... if COMODO smash your system to the point where you can't logon - you just F12 - or whatever F-key your system uses - and boot into Safe Mode and whitelist the files while in Safe Mode.

I have never seen it that bad. The worst I have seen is AMD graphics drivers get auto-sandboxed and cause some problems - even a black screen (boot but nothing visible) - but the above is a way to deal with that sort of problem.

This is why it is recommended by experienced MT members that have experience with COMODO, that advanced configuration of COMODO should be undertaken by users that are advanced Windows users before they even put COMODO onto their system.

You can ask @Umbra, @DracusNarcrym , and others that participated in it - about our private COMODO experiment; bottom line is you got to know how to get yourself out of trouble no matter which soft you are using.

easiest way out of trouble is macrium reflect. I have it on my boot menu.

 

[hjlbx]

easiest way out of trouble is macrium reflect. I have it on my boot menu.

LOL... I get you @shmu26 , but technically, that's cheating... you ain't gonna learn anything that way...

 

[shmu26]

LOL... I get you @shmu26 , but technically, that's cheating... you ain't gonna learn anything that way...

gives you a chance to pick yourself up off the ground and try again, and maybe get it right the second time...