Re: IFS share /QIBM and /QIBM/ProdData/OS400/DirSrv

Hello Andrew,

Am 27.02.2020 um 17:24 schrieb Andrew Lopez (SXS US) <Andrew.Lopez@xxxxxxxxxxxxxxxxxx>:

Instead of matching a pattern on the file contents (which it also does for viruses), it matches the pattern of behavior (for ransomware): reading a file, doing intense mathematical formulas, writing back an entirely new version of the file.

How's that different from a user *wanting* to encrypt stuff? I bet that and maybe creating a ZIP file with many files might trigger false alarms.

While I prefer the Sophos solution, the Cisco product can also monitor for suspicious heuristics.

Translate: "They do guesswork". :-)

If you're referring to the Firepower stuff: Tested that buggy pile of perl scripts four years ago. The management appliance proved extremely resource demanding and still slow. In the course of one year with many updates in between, I hammered out many TAC requests, pointing out bugs, glitches or simple unbearable slowness of some functions (on their own hardware, that is).

Not to mention the countless false-positive "indicators of compromise", and often blocking legit content from outside. Breaking into SSL encryption was another good intention, bad designed part. This definitely breaks certificate pinning and sometimes, some websites appeared damaged on the client, because of scanning timeouts and whatnot.

In the end, management decided that this isn't a good way to go and we switched it off.

:wq! PoC

PGP-Key: DDD3 4ABF 6413 38DE - https://www.pocnet.net/poc-key.asc