I would argue most malware comes down to uneducated users doing the wrong thing - but that's a whole different can of worms :-)
This feels unnecessarily harsh. Those users are the victims of criminal activity. The protective controls could be a lot better.
Windows doesn't offer immutable local file versions to protect against ransomware running as a non-privileged user. It doesn't offer any protection if a single application suddenly starts to overwrite huge amounts of data.
Instead they choose to try and shove OneDrive down our throats as the only answer to ransomware protection.
That just shows that security training is insufficient and admins need to design their systems and networks to account for that fact. Clicking links is part of everybody's job and should not pose a risk to your organization. Enable 2FA for everything exposed to the internet to mitigate phished credentials.
Stop trying to fix the user: https://www.schneier.com/wp-content/uploads/2016/09/Stop-Try...
Having said that, two things worth considering in my case:
1. My laptop is relatively old and, I think, overdue for replacement (8GB RAM, really?)
2. Windows Defender + Airlock + CrowdStrike + Netskope + Nessus seems an expectedly heavy load on a system
"Contrary to what I've said" while you add in an extra third party product that I didn't mention.
Difficult to be effective when it's disabled by default.
>Also restore points?
By using System Restore, you can undo these changes without affecting your personal files
https://support.microsoft.com/en-au/windows/system-restore-a...
