Zero Trust (Solution Vote)

[danb]

When you are on Windows 10 or on Windows 11 with SAC disabled, Simple Windows Hardening is an excellent addendum to VoodooShield (and SWH is set and forget). VoodooShield is excellent against and executables and good against scripts, using SWH blocks scripts in user folders, making them a great combo.

Please keep in mind, VS does not block anything globally, and will auto allow a new item if it is perfectly safe to do so. In other words, VS blocks scripts intelligently, not blindly.

 

[Sandbox Breaker]

Please keep in mind, VS does not block anything globally, and will auto allow a new item if it is perfectly safe to do so. In other words, VS blocks scripts intelligently, not blindly.

Is there a way to disable user alerts? Such as an enterprise environment and not wanting users to allow something?

 

[danb]

Is there a way to disable user alerts? Such as an enterprise environment and not wanting users to allow something?

Sure, there are several ways .

1) VS Settings / Basic tab: disable the "Enable balloon notifications and user prompts" option. This is a great way to go for consumers because the VS desktop shield gadget will still flash, so the user knows something was blocked.

2) VS Settings / Web Management tab: enable the "Require admin approval before letting the user allow new, non-whitelisted files" option. This is mainly for SMB / Enterprise use cases, but here is no reason you could not use it for your grandpa or child.

3) You could create a folder rule to silently block all user space folders. I have not played around with this much, but I think it would work really well for a lot of people.

And please keep in mind you can always set a password to VS so that users cannot change the settings. There are probably other ways to prevent users from clicking the allow button in VS, and if I think of more I will post them .

Also please keep in mind that any Off, Disable or Install Mode switch in ANY Zero-Trust product is effectively the exact same as an allow button . For example, from this thread...

How I got infected last time thread

Last time was couple years ago my uncle without my permission installed pirated games ,one was bundled with malware into my PC while we celebrated a holiday. Unfortunately had to reflash /reinstall windows after what happened just in case .

malwaretips.com

I would also point out that given the exact same scenario, @RoboMan would have simply disabled any traditional Deny-by-default product he might have had installed (the non-prompting, non-file insght kind ), especially since it would have lacked the benefits of file insight and user recommendations. I could write a book on this subject... but I will say that working directly with end-users since 1999 really helped me to understand their thought processes and what UI design most users would consider to be user-friendly, and would be able to safely use.

 

[ErzCrz]

Really torn between H_C and Comodo. H_C locks down my system and I'm inheritently more cautious running new software and liking the Install by Smartscreen. Comodo is great albeit a bit outdated, it stops all malware even if it's AV module isn't great. (Side note: CIS downloads light version of Database by default instead of full signature and heuristics turned off instead of low by default). Can't decide just now, will sleep on it

 

[Sandbox Breaker]

Sure, there are several ways .

1) VS Settings / Basic tab: disable the "Enable balloon notifications and user prompts" option. This is a great way to go for consumers because the VS desktop shield gadget will still flash, so the user knows something was blocked.

2) VS Settings / Web Management tab: enable the "Require admin approval before letting the user allow new, non-whitelisted files" option. This is mainly for SMB / Enterprise use cases, but here is no reason you could not use it for your grandpa or child.

3) You could create a folder rule to silently block all user space folders. I have not played around with this much, but I think it would work really well for a lot of people.

And please keep in mind you can always set a password to VS so that users cannot change the settings. There are probably other ways to prevent users from clicking the allow button in VS, and if I think of more I will post them .

Also please keep in mind that any Off, Disable or Install Mode switch in ANY Zero-Trust product is effectively the exact same as an allow button . For example, from this thread...

How I got infected last time thread

Last time was couple years ago my uncle without my permission installed pirated games ,one was bundled with malware into my PC while we celebrated a holiday. Unfortunately had to reflash /reinstall windows after what happened just in case .

malwaretips.com

I would also point out that given the exact same scenario, @RoboMan would have simply disabled any traditional Deny-by-default product he might have had installed (the non-prompting, non-file insght kind ), especially since it would have lacked the benefits of file insight and user recommendations. I could write a book on this subject... but I will say that working directly with end-users since 1999 really helped me to understand their thought processes and what UI design most users would consider to be user-friendly, and would be able to safely use.

If a file is too large for WLC to analyse... Will it still allow the file to run. I've got mine to only allow WLC safe files.

 

[Zero Knowledge]

H_C & AppGuard & OSarmor. I change between those 3 all the time. Never got into VS for some reason.

 

[maximus]

I voted VS, I use it since feew years

 

[ichito]

Voted "other" what means SpyShelter. Not to listing SS is for me the sign that author is not enough experienced.

 

[piquiteco]

@ichito I think he forgot, so he put "another solution" I suppose that's it.

 

[Sandbox Breaker]

Voted "other" what means SpyShelter. Not to listing SS is for me the sign that author is not enough experienced.

Because I missed SS. I'm an enterprise guy. This isn't my hobby but my career. I've been working in IT since 16 years old and security for the last 10 years.

 

[mkoundo]

I'm quite surprised OSArmor didn't get more votes. Seems ideal as a second line of defence.

 

[danb]

If a file is too large for WLC to analyse... Will it still allow the file to run. I've got mine to only allow WLC safe files.

If the file is too large, then it will be blocked either way. Basically, if anything goes wrong, block the file .

 

[Sandbox Breaker]

If the file is too large, then it will be blocked either way. Basically, if anything goes wrong, block the file .

Perfect!

 

[danb]

Voted "other" what means SpyShelter. Not to listing SS is for me the sign that author is not enough experienced.

SpyShelter is no doubt a great product, but in all fairness, it has not been included in similar polls in the past...

 

[ichito]

Haha
@danb in fact SS wasn't presented but please... I'm not ironic...what is the proof of? SS is developed since actually 14 years, longer than your VS and some other apps on the list.
Screenshots you attached are proof of nothing... sorry.

 

[Andrezj]

Voted "other" what means SpyShelter. Not to listing SS is for me the sign that author is not enough experienced.

it is just a opinion popularity poll which applies only to users here (which most are the same ones voting on the same poll at other forusm), voodooshield is promoted real hard here, with all the free licenses and giveaways, a product such as spyshelter has very little exposure here, then there are technologies in the poll that are not intended for consumers and they do not promote their product at places like this, so it is unlikely they would be popular
wdac, for example, is used across the millions of enterprise windows endpoints so the result in that poll has little indication of reality
the list of products is determined by the poll creator, there is always bias in such poll
the comparisons in that poll make little sense

 

[danb]

Haha
@danb in fact SS wasn't presented but please... I'm not ironic...what is the proof of? SS is developed since actually 14 years, longer than your VS and some other apps on the list.
Screenshots you attached are proof of nothing... sorry.

Hehehe . You get my point though, right?

 

[danb]

it is just a opinion popularity poll which applies only to users here (which most are the same ones voting on the same poll at other forusm), voodooshield is promoted real hard here, with all the free licenses and giveaways, a product such as spyshelter has very little exposure here, then there are technologies in the poll that are not intended for consumers and they do not promote their product at places like this, so it is unlikely they would be popular
wdac, for example, is used across the millions of enterprise windows endpoints so the result in that poll has little indication of reality
the list of products is determined by the poll creator, there is always bias in such poll
the comparisons in that poll make little sense

Speaking of irony... if what you are saying is true, then why did you create this poll?

Users do not vote for a product because they got a free license, they vote for a product because they think it is the best. In fact, someone who received a free license would be more likely to envy a $90 product if it were truly better, and would likely vote in that direction. Not that it matters, VS has not had a giveaway on MT for years, and is not promoted on MT at all.

The above poll had 153 votes total, which is probably almost enough to be a true representative sample.

I just wish you would have kept that one poll up before you lost bigtime and decided to take it down before I could get a screenshot.

Merry Christmas JT / hjlbx !!!

 

[Shadowra]

it is just a opinion popularity poll which applies only to users here (which most are the same ones voting on the same poll at other forusm), voodooshield is promoted real hard here, with all the free licenses and giveaways, a product such as spyshelter has very little exposure here, then there are technologies in the poll that are not intended for consumers and they do not promote their product at places like this, so it is unlikely they would be popular
wdac, for example, is used across the millions of enterprise windows endpoints so the result in that poll has little indication of reality
the list of products is determined by the poll creator, there is always bias in such poll
the comparisons in that poll make little sense

You're talking nonsense.
I was offered Voodooshield but I didn't vote for it!
I have tested Voodoo so much that it is excellent for me. I have also brought up various attack techniques that I know of to make the software better.

And especially that we are a minority of users to have had it as a gift, @danb must be paid for his work

 

[Andrezj]

Users do not vote for a product because they got a free license, they vote for a product because they think it is the best.

that is an assumption and hardly correct and the reason that opinion polls are hardly predictive of what is best
best is a generic criteria that can mean a number of things to each user individually

they vote for a product because they think it is the best.

they might think it is best, best can mean any of a number of things to each user, maybe they just like the color of the gui
also it proves nothing if those that voted have not used all the products in the poll, which surely virtually all of them have not so they have no basis for judgment to say voodooshield is best
so again it is merely a popularity contest based upon personal factors
half the people that voted for voodooshield in this poll are not actively using it, so that says something about your product and the polling

In fact, someone who received a free license would be more likely to envy a $90 product if it were truly better, and would likely vote in that direction.

how absurd, you are saying that they would lie in their response to a poll out of envy

Not that it matters, VS has not had a giveaway on MT for years, and is not promoted on MT at all.

you hand out free licenses continuously, you advertise here at mt for people to send you a request, and you use mt as if it is the voodooshield promotion platform
the other products do no such thing, and most users here have never used them

try harder because there is ample evidence posted by your own product users here that it is not that great