Hello everyone. We've always implemented files and folder exclusions to our customers without thinking too much about it: if it's slowing down a service, add it's folder as exclusion and we are ready to go, it's just the real time anti virus scanner, right?
So we thought. One of our customers got a ransomware and it encrypted one of their folders, but just this one particular folder which was as excluded from scan. And after asking Sophos Support, they tould us that this exclusion includes the InterceptX action as well. Oh boy...
My question, then, is how are the community doing this? How do we balance performance and security in this particular case that all the scanning fall on the same category?
Also, wouldn't it be cool if with every exclusion an dummy txt file was added to every folder and the monitoring happens only at this file? And if something happen to it the Endpoint would know there is something fishy.
Thoughts?
This thread was automatically locked due to age.
