Serious Discussion Very detailed report (58 page with executive summary) on Windows SAC feature by German Federal Office for Information Security

[LennyFox]

Hi, I was searching the internet on the differences of SAC - WDAC ISG and Defender in Zero Trust mode, when I stumbled on this very detailed and informational study

https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Smart_App_Control/Studie_Smart_App_Control.pdf?__blob=publicationFile&v=2

 

[Bot]

Thank you for sharing this resource. It indeed provides a comprehensive analysis of Windows Smart Application Control (SAC) and how it compares to Windows Defender Application Control (WDAC) and Zero Trust model. This should be helpful for those interested in Windows security features.

 

[SeriousHoax]

Too lazy to read the whole thing. @Andy Ful might like this.

 

[7Oz-64]

@LennyFox
Thank you for posting, really interesting

 

[LennyFox]

I have bought a new laptop (HP 16GB, 5700U, 1TB SSD) because my wife starting using my old laptop (HP 16GB, 4600U, 512GB SSD) when I was learning Linux on and old Desktop and I was wondering whether I would stick to WDAC-ISG (as configured by WHHL utility of @Andy Ful ) or would switch to SAC. After browsing the report and I think (for all who found the report TLDR)

I will stick with WDAC-ISG combined with Defender with cloud level Zero Tolerance (is Configure Defender in MAX mode), because users have zero control over SAC (and WHHL also provides very strong protection and it allows exceptions to be made by the user).

 

[Andy Ful]

Hi, I was searching the internet on the differences of SAC - WDAC ISG and Defender in Zero Trust mode, when I stumbled on this very detailed and informational study

https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Smart_App_Control/Studie_Smart_App_Control.pdf?__blob=publicationFile&v=2

I read it in January. Interesting stuff.

 

[monkeylove]

In our humble opinion, SAC may be considered as a kind of automatic way to use WDAC. The trade-off for the user or organization is to provide optional diagnostic data to Microsoft. This acceptance of this trade-off should be evaluated by any organization. Configuring a WDAC policy for many computers in an organization and maintaining it for different kind of users can be a complex task. By “outsourcing” the WDAC policy definition to the Microsoft’s cloud-based backend evaluation related to Microsoft Defender Antivirus, SAC automatizes the full process of WDAC policy definition and maintenance. That way, the files are executed in the system if and only if their reputations are known to be good. This design introduces three direct consequences:

...

 

[BSONE]

I read it in January. Interesting stuff.

From a pure security point of view what would you recommend for a new Windows installation: SAC or WHH?
The reason I ask, is that from my experience SAC has evolved from block everything to allowing most apps and processes (such as Office) over the last year.

 

[Andy Ful]

From a pure security point of view what would you recommend for a new Windows installation: SAC or WHH?

From a pure security point of view (with limited ability of new application installations):
SAC for inexperienced users (no home administrator).
WHHLight package (SAC ON or OFF) for home administrators.