would Sophos HIPS be capable of preventing locky desaster?

Hello Tom,

feel somewhat safer
what would feeling somewhat safer change for you and your users? Or how does feeling less safe impair your work?

Please note that you can decide to merely alert only for suspicious (verdächtiges) behaviour, if you enable detect malicious behaviour such activity is blocked (but there's no guarantee that this is early enough). HIPS is an extra similar to an airbag in your car - you (hopefully) don't drive less carefully just because the airbag could mitigate the consequences of an accident. 

Christian

Hello Tom,

feel somewhat safer
what would feeling somewhat safer change for you and your users? Or how does feeling less safe impair your work?

Please note that you can decide to merely alert only for suspicious (verdächtiges) behaviour, if you enable detect malicious behaviour such activity is blocked (but there's no guarantee that this is early enough). HIPS is an extra similar to an airbag in your car - you (hopefully) don't drive less carefully just because the airbag could mitigate the consequences of an accident. 

Christian

Christian, thanks.

Of course we warn our users and educate them not to open such attachments. I just wanted to know if this is a good setting for installing a kind of airbag for this extremely nasty kind of trojan. We have users that have write access on quite an enormous amount of files, and I'd fear the day that I need to restore those files from backup.

Kind regards,

Tom

Hello Tom,

if this is a good setting
I daresay any more "paranoid" and restrictive setting which doesn't interfere with normal operation is a good one. For On-Access Scan inside archive files is not recommended (and arguably not necessary), I'd enable Scan for ... Suspicious files though (and of course all three Check files on options as well as Live Protection). You could test the actual impact (i.e. performance penalty) of Extensions->Scan all files (not recommended) and if it's acceptable assess the effect on detections. 

Please have a look at Comparison of Sophos's Malicious File Detection Technologies and the related articles.

As an aside: When there's a "new" campaign you might see a significant number of Mal/Generic-S (both cleanable and not) and named detections whose analyses nevertheless describe them as generic and list send a sample as one of the options. Once or twice on such occasions I turned off automatic cleanup with Deny access only as fallback in the central part of our network in order to obtain samples for the "interesting" detections (not only the files mentioned but also scraping the user's %Temp%, %AppData% and browser cache for files which might have taken part in "delivering" the actual threat).   

Christian