Re: [Full-disclosure] Windows Software Restriction Policy Protection Bypass
This MS answer speaks volumes to their approach to security (I had
similar made to me in the past)
09.06.06 - Vendor response
"Software Restriction Policy and Group Policy are not meant to be
complete security features...For full security, we recommend using ACLs
to protect the appropriate resources in your environment..."
Maybe they should update some of their docs:
From
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx
"...Software restriction policies are a new feature in Microsoft(r)
Windows(r) XP and Windows Server 2003. This important feature provides
administrators with a policy-driven mechanism for identifying software
programs running on computers in a domain, and controls the ability of
those programs to execute. Software restriction policies can improve
system integrity and manageability—which ultimately lowers the cost of
owning a computer..."
"...Software restriction policies are a part of Microsoft's security
and management strategy to assist enterprises in increasing the
reliability, integrity, and manageability of their computers. Software
restriction policies are one of many new management features in
Windows XP and Windows Server 2003.
This article provides an in-depth look at how software restriction
policies can be used to: Fight viruses,Regulate which ActiveX controls
can be downloaded,Run only digitally signed scripts,,Enforce that only
approved software is installed on system computers,Lockdown a
machine..."
From
http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/xpsgch06.mspx
"...Software restriction policy provides administrators with a way to
identify software and control its ability to run on local computers.
This tool can help protect computers that run Microsoft(r) Windows(r)
XP Professional against known conflicts and safeguard them against
malicious software such as viruses and Trojan horse programs. Software
restriction policy integrates fully with the Active Directory(r)
directory service and Group Policy. You can also use it on stand-alone
computers...."
Dinis Cruz
Owasp .Net Project