4 ms·

How does that usually work out? Personally, I would throw out a vendor who asked me to disable my AV. I don't mind whitelisting a directory or making certain ad

by jm4 7y ago

How does that usually work out? Personally, I would throw out a vendor who asked me to disable my AV. I don't mind whitelisting a directory or making certain adjustments, but it's hard to take them seriously if they can't work with AV. Cylance isn't that bad. I ran it for 3 years. The false positives were annoying, but it also stopped a lot of nasty stuff that our traditional AV wasn't detecting. I'm in an environment where there's very little appetite for risk and highly standardized endpoints so it generally worked out. We ran it alongside Bit9 (now Carbon Black). They were both catching the same things and CB has more features. Once CB got to the point where it could be the only AV we ditched Cylance.

gregmac 7y ago
What type of "nasty stuff" did it stop? Are you talking servers or workstations here? How did that nasty stuff get far enough in that it had to be "stopped" by AV? (I don't mean this to sound snarky, I'm genuinely interested in what type of real-world infections are happening and being detected. My experience is limited to internet-facing endpoints that have no security or are horribly outdated -- which is typically a bigger failure of IT to begin with -- and non-technical end-users running random executables from e-mails or shady websites)
- jm4 7y ago
  Mostly crap that was targeted at users via email. Weird droppers, infected documents, PDFs loaded with some exploit. Lots of stuff that doesn't show up on Virus Total. We see a lot of stuff that attacks unpatched software and there's quite a bit that gets through the email gateway. We see frequent spear phishing scenarios where it's not uncommon for the attacker to email back and forth for a while under some pretext before delivering a malicious payload. Several situations where a party we are communicating with has been breached and the attacker will use them as a jumping off point to get to us - basically a business email compromise scenario where they jump into the middle of a conversation or document transaction with a malicious payload. We patch too, block a lot of connections at the firewall and have other layers, but it's nice when the endpoint protection stops it.
Trias11 7y ago
Basically when Cylance is enabled - other software dies. We report problem, customer complains to cylance and cylance people come begging for logs to debug. Some admin volunteer his time to babysit cylance people to give them what they need. Week or two pass by productively with cylance disabled and then some software dies again. ps aux | grep cylance -- some other admin turned it back on. Rinse and repeat. Quickest way to solve any problem for us is to check if cylance running. We basically charge customer extra to keep them happily married to cylance. I do realize that it's some exec' reputation on the line for approving this vendor purchase - hence we're being diplomatic by charging extra and being quiet.

by jm4 7y ago

gregmac 7y ago

What type of "nasty stuff" did it stop? Are you talking servers or workstations here? How did that nasty stuff get far enough in that it had to be "stopped" by AV? (I don't mean this to sound snarky, I'm genuinely interested in what type of real-world infections are happening and being detected. My experience is limited to internet-facing endpoints that have no security or are horribly outdated -- which is typically a bigger failure of IT to begin with -- and non-technical end-users running random executables from e-mails or shady websites)

jm4 7y ago
Mostly crap that was targeted at users via email. Weird droppers, infected documents, PDFs loaded with some exploit. Lots of stuff that doesn't show up on Virus Total. We see a lot of stuff that attacks unpatched software and there's quite a bit that gets through the email gateway. We see frequent spear phishing scenarios where it's not uncommon for the attacker to email back and forth for a while under some pretext before delivering a malicious payload. Several situations where a party we are communicating with has been breached and the attacker will use them as a jumping off point to get to us - basically a business email compromise scenario where they jump into the middle of a conversation or document transaction with a malicious payload. We patch too, block a lot of connections at the firewall and have other layers, but it's nice when the endpoint protection stops it.

Trias11 7y ago

Basically when Cylance is enabled - other software dies. We report problem, customer complains to cylance and cylance people come begging for logs to debug. Some admin volunteer his time to babysit cylance people to give them what they need. Week or two pass by productively with cylance disabled and then some software dies again. ps aux | grep cylance -- some other admin turned it back on. Rinse and repeat. Quickest way to solve any problem for us is to check if cylance running. We basically charge customer extra to keep them happily married to cylance. I do realize that it's some exec' reputation on the line for approving this vendor purchase - hence we're being diplomatic by charging extra and being quiet.