undefined | Better HN

0 pointscube0010mo ago0 comments

> I would argue most malware comes down to uneducated users doing the wrong thing

This feels unnecessarily harsh. Those users are the victims of criminal activity. The protective controls could be a lot better.

Windows doesn't offer immutable local file versions to protect against ransomware running as a non-privileged user. It doesn't offer any protection if a single application suddenly starts to overwrite huge amounts of data.

Instead they choose to try and shove OneDrive down our throats as the only answer to ransomware protection.

0 comments

ropable10mo ago

As someone working in infosec for a largish 2000 seat organisation - it's honestly not inaccurate. No matter how much accessible information security training we try to provide and the EDR controls we implement, >95% of our incidents involve an end-user following (sometimes extremely obvious) phishing links. And contrary to what you've said, Windows Defender (in conjunction with Airlock) has actually saved us from ransomware attacks.

mr_mitm10mo ago

> No matter how much accessible information security training we try to provide and the EDR controls we implement, >95% of our incidents involve an end-user following (sometimes extremely obvious) phishing links.

That just shows that security training is insufficient and admins need to design their systems and networks to account for that fact. Clicking links is part of everybody's job and should not pose a risk to your organization. Enable 2FA for everything exposed to the internet to mitigate phished credentials.

Stop trying to fix the user: https://www.schneier.com/wp-content/uploads/2016/09/Stop-Try...

supertrope10mo ago

If an entire company can be paralyzed by tricking a single employee it's a process issue. Just like how wiring out $100,000 same day on the order of a single employee should be blocked by internal controls.

BLKNSLVR10mo ago

Where I work has recently implemented Airlock and my laptop feels a lot less responsive since. I'm aware of the whole security trade-off, just wondering how noticeable it has been in your organisation, if at all?

Having said that, two things worth considering in my case:

1. My laptop is relatively old and, I think, overdue for replacement (8GB RAM, really?)

2. Windows Defender + Airlock + CrowdStrike + Netskope + Nessus seems an expectedly heavy load on a system

3eb7988a166310mo ago

Not sure the exact combination of internal security nonsense used, but my corporate laptop idles at a good 20% cpu utilization. It would not surprise me at all to know that the products are stepping over themselves and scanning each other. Double plus ungood is that any programming tool I use seemingly gets extra scrutiny and can take 10x as long as I know it would on a non-compromised Linux machine.

cube00OP10mo ago

> And contrary to what you've said, Windows Defender (in conjunction with Airlock)

"Contrary to what I've said" while you add in an extra third party product that I didn't mention.

eviks10mo ago

Isn't "Controlled folder access" part of that protection? Also restore points?

cube00OP10mo ago

>Isn't "Controlled folder access" part of that protection?

Difficult to be effective when it's disabled by default.

>Also restore points?

By using System Restore, you can undo these changes without affecting your personal files

https://support.microsoft.com/en-au/windows/system-restore-a...

eviks10mo ago

> without affecting your personal files

Thus System

> Difficult to be effective when it's disabled by default

The initial goalpost was lack of any protection / no alternatives to onedrive

cube00OP10mo ago

> Thus System

What other "restore point" functionality does Windows offer by default?

> The initial goalpost was lack of any protection / no alternatives to onedrive

The context was "uneducated users"; they're unlikely to know they could enable controlled access.

They're further unlikely to be able to handle the application problems it introduces such as games having problems saving their state which why it's disabled by default.

j / k navigate · click thread line to collapse

0 comments

ropable10mo ago

mr_mitm10mo ago

Stop trying to fix the user: https://www.schneier.com/wp-content/uploads/2016/09/Stop-Try...

supertrope10mo ago

BLKNSLVR10mo ago

Having said that, two things worth considering in my case:

1. My laptop is relatively old and, I think, overdue for replacement (8GB RAM, really?)

2. Windows Defender + Airlock + CrowdStrike + Netskope + Nessus seems an expectedly heavy load on a system

3eb7988a166310mo ago

cube00OP10mo ago

> And contrary to what you've said, Windows Defender (in conjunction with Airlock)

"Contrary to what I've said" while you add in an extra third party product that I didn't mention.

eviks10mo ago

Isn't "Controlled folder access" part of that protection? Also restore points?

cube00OP10mo ago

>Isn't "Controlled folder access" part of that protection?

Difficult to be effective when it's disabled by default.

>Also restore points?

By using System Restore, you can undo these changes without affecting your personal files

https://support.microsoft.com/en-au/windows/system-restore-a...

eviks10mo ago

> without affecting your personal files

Thus System

> Difficult to be effective when it's disabled by default

The initial goalpost was lack of any protection / no alternatives to onedrive

cube00OP10mo ago

> Thus System

What other "restore point" functionality does Windows offer by default?

> The initial goalpost was lack of any protection / no alternatives to onedrive

The context was "uneducated users"; they're unlikely to know they could enable controlled access.

They're further unlikely to be able to handle the application problems it introduces such as games having problems saving their state which why it's disabled by default.

j / k navigate · click thread line to collapse