HIPS with Outbound Protection

[firzen771]

can somebody name the HIPS that include outbound network control?

[ccsito]

Appdefend from Ghost Security
http://www.ghostsecurity.com/appdefend/

[firzen771]

tried that, didnt really like it, but could u or anyone else name all the possible choices for this?

[WSFuser]

SSM is another.

iirc, Prosecurity has it too. But I may be wrong.

[bellgamin]

Originally Posted by WSFuser

SSM is another.

Yes, what WSF said.

[ccsito]

Originally Posted by WSFuser

SSM is another.

iirc, Prosecurity has it too. But I may be wrong.

According to this list, Prosecurity does have it.


http://www.proactive-hips.com/featurelist.php

[firzen771]

ive tried prosecurity, it is very good, but just didnt like it, i could try SSM, but i heard that its very noisy

[cruelsister]

Try the new version of ProSecurity(1.4). After the first day of use it hasn't made a peep unless I run malware tests.

[WSFuser]

Originally Posted by ccsito

According to this list, Prosecurity does have it.


http://www.proactive-hips.com/featurelist.php

Isnt this it:

20. Access Network(Advanced Settings Provided)

[farmerlee]

Yup prosecurity free and paid has network control. You can also try online armor, its a firewall and hips combined. You can easily disable the firewall component if you don't need it.

[solcroft]

Originally Posted by firzen771

ive tried prosecurity, it is very good, but just didnt like it, i could try SSM, but i heard that its very noisy

SSM is one of the more user-friendly "dumb" HIPS on the market right now.

Granted, it will generate a certain level of noise, given that it IS a "dumb" HIPS, but if you can live with ProSec, you'll do just fine with SSM.

[WSFuser]

Also you can use SSM's learning mode for a few days then turn it off. Afterwards, you shouldnt get so many popups.

[chrome_sturmen]

im using online armor free edition- it has outbound network control of applications (dns api control)

[Vikorr]

Prevx has outbound protection

[Espresso]

DSA and Threatfire with advanced rule (TF currently only has the option of Allow or Quarantine.)

[ggf31416]

Comodo 3 is more a HIPS with firewall than a firewall with HIPS.

[firzen771]

heres the products ive tried so far:

- Comodo 3 (currently using)
- Prosecurity
- Online Armor
- Ghost Security Suite
- Threatfire (liked it, but less control, and couldnt get any network control)
- SSM
- Prevx Free (this vers. doesnt even run realtime so that wouldnt work)


products that i mite try so far, will add more as i learn about more:

- DSA (dont know much about it)

[LUSHER]

Originally Posted by ggf31416

Comodo 3 is more a HIPS with firewall than a firewall with HIPS.

Despite the wide scope of Comodo's Defense+ module, I disagree.

A HIPS with firewall is stuff like SSM, ProSecurity where firewall functions are just one of several functions, and nobody ever turns off everything and keeps the firewall functions but rather the reverse happens.

For COmodo 3, there are lots of people who keep the firewall but turn HIPS off.... This makes the firewall part at least an equal partner if not senior partner..

[bellgamin]

Originally Posted by chrome_sturmen

im using online armor free edition- it has outbound network control of applications (dns api control)

OA's outbound control is performed by its firewall module. As far as I know, OA's HIPS does NOT perform outbound control.

Ergo, if you deactivate OA's firewall, your outbound control wil disappear. Notice the topic title -- it says "HIPS with Outbopund Protection", not firewalls. Therefore, OA doesn't fit the topic.

[chrome_sturmen]

Originally Posted by bellgamin

OA's outbound control is performed by its firewall module. As far as I know, OA's HIPS does NOT perform outbound control.

Ergo, if you deactivate OA's firewall, your outbound control wil disappear. Notice the topic title -- it says "HIPS with Outbopund Protection", not firewalls. Therefore, OA doesn't fit the topic.

I don't use online armor's firewall, I use it for it's h.i.p.s. I've invested too much time in agnitum to make a firewall change.

Note the second option from bottom on the permissions section, "use dns api".
I would think this is a base level form of application outbound network control.
When I disabled agnitum and set avira's updater to ask when using dns api in online armor, I got the following prompt:






Im no wizard, but this seems a form of outbound network control- and quite sturdy. Thoughts?

[firzen771]

in my list did i miss any other HIPS with outbound protection?

[aigle]

Neoava Guard beta v 3

[firzen771]

i read on the site that developement has been stopped for now, so id pass on that till developement starts again

[aigle]

Correct!

[Rasheed187]

i read on the site that developement has been stopped for now, so id pass on that till developement starts again

Yes, but this doesn´t mean that it doesn´t offer good protection, to my surprise, the outbound protection was even better than in ZAP v6, NG could stop certain leaktests, while ZAP could not.