EDR Protected Files/Protected Data as anti-ransom and hardening measure?

1

While I was configuring CIS 2027 I was fiddling a bit with EDR (formerly HIPS) and noticed something, EDR in itself is too chatty and I don’t like using it. However, I noticed one part of it might be beneficial to use against ransomware as well as for hardening of security.

Protected Files will trigger EDR on modification, but not read. Protected Data however entirely blocks access even for just reading. Depending on needs, you can actually use EDR to further protect files that matter to you without making EDR too chatty and too annoying.

Containment blocks modifications, but doesn’t block reading of files as far as I know reading the documentation, meaning one can still read and send data to remote server. Protected Data setting also blocks that.

It would be smart to use Protected Data on browser profile folder for example. This way nothing unknown can even read your locally stored passwords or cookies.

This way you add additional layer of protection on top of Containment while not making CIS any more annoying as those scenarios most likely will never get triggered.

1 Like
2

You are worried about data stealers, which is very Wise as these greatly outnumber ransomware. Comodo has such as these covered pretty well with Containment AND the outbound alerting Firewall. The FW protects well as even on files that are not contained one would get an Outbound alert (but a majority of time these blocks would be the default action).

3

Agree with @cruelsister as she very well demonstrates in her Comodo Firewall vs New Data Stealer video.. You can indeed add those to protected data as long as you interpret the alerts well. You can even add a special group under File rating and then create a specific EDR/hips rule though I’ve not played around with that much and your better with a separate secure password manager like keepass which is encrypted in itself though on the back of your post, I’ve added the folders of KeePass databases to Protected Data :slight_smile: