Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 898688" data-attributes="member: 32260">System-wide anti-exploit solutions can always produce issues. Using such a setup without auditing and detailed event logging is not a good idea. So, for most users, the better solution is just updating frequently.Generally, in the home environment, it is easier to apply the setup which is focused on preventing malware, than the setup which is based on mitigating the malicious actions.The situation in enterprises is very different due to common (not patched) system/software vulnerabilities, network vulnerabilities, remote administration vulnerabilities, server vulnerabilities, etc. It is very hard to prevent malware - the large attack surface requires strong mitigations to make the attack less painful and save time to neutralize malware.Edit.There can be some reason for using basic anti-exploit protection for concrete applications, plugins, addIns, and extensions that are commonly abused in the wild. One of such simple mitigations is blocking/restricting child processes.</blockquote>

[QUOTE="Andy Ful, post: 898688, member: 32260"] System-wide anti-exploit solutions can always produce issues. Using such a setup without auditing and detailed event logging is not a good idea. So, for most users, the better solution is just updating frequently. Generally, in the home environment, it is easier to apply the setup which is focused on preventing malware, than the setup which is based on mitigating the malicious actions. The situation in enterprises is very different due to common (not patched) system/software vulnerabilities, network vulnerabilities, remote administration vulnerabilities, server vulnerabilities, etc. It is very hard to prevent malware - the large attack surface requires strong mitigations to make the attack less painful and save time to neutralize malware. Edit. There can be some reason for using basic anti-exploit protection for concrete applications, plugins, addIns, and extensions that are commonly abused in the wild. One of such simple mitigations is blocking/restricting child processes. [/QUOTE]

Verification