Question about OA HIPS

Can anyone tel me what does trusted and untrusted applications
mean in OA HIPS. If I change a trusted application to untrusted, its all
permissions are lost but if I mark an untrusted application to trusted
I don,t see any change in its permissions.

Thanks

 

Hi aigle,

OA will not monitor behavior of a trusted apps as it does for an untrusted one

Regards,

MaB

 

Thanks. It was simple but I could not get it, was just lost in checking permissions in advanced options.

Thanks again.

 

Ok, can u tel what is the difference between the two:

1- Protect from remote code control( i guess it means memory modification, remote thread creation etc. Am I correct?).
2- Protect from remote data modification

Thanks

 

Hi Aigle,

If you look at those Advanced options, changing a program to trusted changes the default action to Allow All. Changing a program to Unknown, changes the default action to Ask.

 

This from OA's on-line help.

 

Hmmm.... thanks. I anted to know in terms of pop up. I mean what type of pop ups these actions will generate like memory modification, create remote thread, etc etc.

Thanks

 

True

On changing a program from untrusted to trusted, default actions for advanced options in this case remain marked as Ask though infact I get no more pop ups. Do you get the same findings?

Thanks

 

Never seen settings like these. Will post screenshots later.

 

Your pics are from OAs 'Standard Mode'. OA Free only offers this mode, with OA paid you can switch to 'Advanced Mode' (and 'Banking Mode').
However, in 'Standard Mode' you can only choose Allow, Block or Ask (n/a) and if you 'Trust' a programm all these 'Permissions' are kind of bypassed, or like OA Help tells us "These settings will not be enforced on Trusted programs."
http://www.tallemu.com/webhelp3/Programs.html#advanced

Cheers

 

Hmmm... i was thinking in that case they will also be shown as Allow rather than Ask.

 

I would interpret the ? (n/a) as not-applicable and therefore ignored which is what you would expect for a trusted program. The ? is a bit misleading. I agree, it would be better if it was shown as Allow.

 

Hi aigle,

You can trust a prog (do what it want after execution) but may be you wich to control when it executes (ask)

MaB

 

OA intercepts all executions in my experience unless allowed by rules or white list. A bit similar to NG.