Reply to thread

Message

<blockquote data-quote="509322" data-source="post: 583855">They can call it whatever they wish, but the way that Kaspersky&#039;s TAM and Application control function together is restricted default-allow.&nbsp; Using a whitelist allows whatever is found on the whitelist while blocking programs not on the whitelist.Of course a user can modify the settings to make it all work as true default-deny.Blocking only digitally unsigned files is not strict default-deny, but rather restricted default-allow.&nbsp; Because you are allowing digitally signed files to execute.&nbsp; That is how AppGuard&#039;s Protected mode currently works - but we&#039;re working on making it selectively block even digitally signed files to increase system protection to maximum extent possible for that protection mode.Absolute blocking is only what is found in AppGuard&#039;s Locked Down mode or other SRP softs - where a files origin, certificate, or anything else does not matter - the file is strictly blocked.Strict blocking (true default-deny) prevents the installation and execution of new programs from User Space.&nbsp; With TAM and Application Control enabled programs can still be installed and executed on the system as well as scripts (mostly assigned to Low Restricted, except for powershell scripts which are not restricted) - and that includes a lot of PUPs\PUAs in the KSN whitelist.The last statement is not a bash of KSN.&nbsp; It is just Kaspersky&#039;s approach to avoid legal problems with vendors that publish questionable, digitally signed programs.&nbsp; Other vendors likewise adopt such an attitude towards digitally signed PUPs\PUAs.&nbsp; It&#039;s a challenging problem for them to solve with everyone&#039;s best interests in mind.</blockquote>

[QUOTE="509322, post: 583855"] They can call it whatever they wish, but the way that Kaspersky's TAM and Application control function together is restricted default-allow. Using a whitelist allows whatever is found on the whitelist while blocking programs not on the whitelist. Of course a user can modify the settings to make it all work as true default-deny. Blocking only digitally unsigned files is not strict default-deny, but rather restricted default-allow. Because you are allowing digitally signed files to execute. That is how AppGuard's Protected mode currently works - but we're working on making it selectively block even digitally signed files to increase system protection to maximum extent possible for that protection mode. Absolute blocking is only what is found in AppGuard's Locked Down mode or other SRP softs - where a files origin, certificate, or anything else does not matter - the file is strictly blocked. Strict blocking (true default-deny) prevents the installation and execution of new programs from User Space. With TAM and Application Control enabled programs can still be installed and executed on the system as well as scripts (mostly assigned to Low Restricted, except for powershell scripts which are not restricted) - and that includes a lot of PUPs\PUAs in the KSN whitelist. The last statement is not a bash of KSN. It is just Kaspersky's approach to avoid legal problems with vendors that publish questionable, digitally signed programs. Other vendors likewise adopt such an attitude towards digitally signed PUPs\PUAs. It's a challenging problem for them to solve with everyone's best interests in mind. [/QUOTE]

Verification