@mattifestation Most NGAV solutions can't maintain a on-endpoint reputation store. And even if they did they'd need to protect it from tampering (a bitch).

← @kwm Twitter archive

Keith

@kwm

@mattifestation Most NGAV solutions can't maintain a on-endpoint reputation store. And even if they did they'd need to protect it from tampering (a bitch).

9/4/2017, 10:40:50 PM

Favs: 0

Retweets: 0

link

Keith

@kwm

@mattifestation Most EDR solutions will be affected as well, but lack of run/block logic means you can check on the endpoint but true-up server-side.

9/4/2017, 10:41:17 PM

Favs: 0

Retweets: 0

link

Keith

@kwm

@mattifestation Perhaps the most useful point to drive home re: local signing status is that it should be used for convenience/speed but never for trust.

9/4/2017, 10:43:12 PM

Favs: 1

Retweets: 0

link