Reply to thread

Message

<blockquote data-quote="danb" data-source="post: 1016958" data-attributes="member: 62850">I forgot to mention… behavior blockers are actually allow-by-default by design. The reason we know this is because they work by allowing everything, except certain suspicious behaviors (they block specific behaviors). They obviously cannot block, and do not want to block every single behavior, which is further proof they are allow-by-default by design, and simply bear no resemblance to the zero-trust model. So behavior blockers must determine what to block and what not to block. That is great when they are correct, but not so great when they are not correct.BTW, a global block of cmd, for example, is not a behavior block. This is a global block, and there is a huge difference. In a global block, behaviors are not evaluated in determining if cmd should be blocked, it is just simply blocked.Most modern AV products include a behavior blocker component that the company has focused on and refined over the years, and it would be difficult or impossible to build a behavior blocker that is even close to the efficacy or usability of the AV products that already offer a behavior blocker, especially when behavior blocking is their company’s specialty.For these reasons, I strongly believe behavior blocking is best implemented into an allow-by-default product like a traditional or next-gen AV. Some of this is opinion and some of this is fact, you can decide what is what <img class="smilie smilie--emoji" loading="lazy" alt="😉" title="Winking face&nbsp; &nbsp; :wink:" src="https://cdn.jsdelivr.net/joypixels/assets/6.6/png/unicode/64/1f609.png" data-shortname=":wink:" />.</blockquote>

[QUOTE="danb, post: 1016958, member: 62850"] I forgot to mention… behavior blockers are actually allow-by-default by design. The reason we know this is because they work by allowing everything, except certain suspicious behaviors (they block specific behaviors). They obviously cannot block, and do not want to block every single behavior, which is further proof they are allow-by-default by design, and simply bear no resemblance to the zero-trust model. So behavior blockers must determine what to block and what not to block. That is great when they are correct, but not so great when they are not correct. BTW, a global block of cmd, for example, is not a behavior block. This is a global block, and there is a huge difference. In a global block, behaviors are not evaluated in determining if cmd should be blocked, it is just simply blocked. Most modern AV products include a behavior blocker component that the company has focused on and refined over the years, and it would be difficult or impossible to build a behavior blocker that is even close to the efficacy or usability of the AV products that already offer a behavior blocker, especially when behavior blocking is their company’s specialty. For these reasons, I strongly believe behavior blocking is best implemented into an allow-by-default product like a traditional or next-gen AV. Some of this is opinion and some of this is fact, you can decide what is what 😉. [/QUOTE]

Verification