Should you turn on Smart App Control?

About this video

• Video Title: Should you turn on Smart App Control?
• Channel: PC Security Channel
• Speakers: Leo
• Duration: 00:06:42

Overview

This video evaluates Windows' Smart App Control feature, explaining its default "evaluation mode" and how to enable it. The speaker tests its effectiveness against ransomware by disabling traditional signatures and using an automation script. The video also touches upon the irreversibility of enabling the feature and briefly introduces Threat Locker as a zero-trust security solution.

Key takeaways

• Smart App Control Default Setting: The feature is enabled by default in "evaluation mode," allowing it to learn and protect without significant user interference, similar to a training mode or a zero-trust approach.
• Irreversible Activation: Once Smart App Control is switched from evaluation mode to "on," it requires administrator privileges and cannot be reverted to evaluation mode without reinstalling Windows. It can only be turned off completely, after which it cannot be re-enabled without a Windows reinstallation.
• Ransomware Test Results: Testing with ransomware samples, even after disabling latest definitions, showed that Smart App Control successfully blocked the execution of malicious files, indicated by a distinct alert compared to standard Windows Defender signatures.
• False Positive Testing: Initial tests with lesser-known applications (like Dependency Walker) suggest that Smart App Control does not appear to generate false positives, unlike some EDR products that might flag unfamiliar programs.
• Sponsor Introduction: The video briefly introduces Threat Locker, a zero-trust security solution that uses behavioral protection and "ring fencing" to control application actions, offering an alternative for enterprise security.