软件限制重策略(国外英语资料).docVIP

软件限制重策略(国外英语资料) The role of software constraint strategy So lets talk about the 3D of the HIPS AD - the program protects the application from malicious modification, deletion, and injection FD - file protection key files are not modified, deleted, and disable malicious programs to create and read files RD - the registry protection registry key location is not modified, read, or deleted Windows own software restriction policy can achieve the above AD and FD, as for RD, can be done by the registry permissions, so it can be said that the Windows itself has the function of 3 d, just dont be familiar. The advantages and disadvantages of the software constraint strategy 1, the advantages of Advantage is obvious, it is part of the system, there is no compatibility problems, do not take up memory, belong to the system bottom protection, the virus cannot be to shut it down, protection is far from HIPS software can match, and it is a driver, even if you dont set it, system will load the driver 2, weaknesses Disadvantage is also evident, compared with the HIPS, it is not flexible and intelligent, there is no learning mode, will not stop the program to create or delete files, it will only prevent default or release, do not ask users, improper rules set, can lead to some program cannot be run. The location of the software restrictions policy Local security - software constraint policy If the software limit policy has no children, right-click it to create a software constraint policy The wildcard of the software restrictions policy The wildcard for? And * two, right? The delegate does not have or a character, * represents no or N characters C: \ * for all programs in c disk C: \ * \ *. * for C plate under the folder of files (such as C: \ Windows folder of the program, while a folder under the program in Windows is invalid) C: \ *. * the program under the root directory of the c disk ? \ *. * for all the programs under the root directory of the partition (including the U disk an