Attack Surface Reduction Rules for Developer Machines [closed]

Question

I teach C++ programming at a Community College. In preparation for coming back to school in the Fall I have been testing our lab machines. During the pandemic our IT department instituted Windows Defender's Attack Surface Reduction Rules. This rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria" seems to prevent my students running or debugging their C++ programs after they are compiled. Does anyone have any experience with this in a college setting or a corporate setting configuring developer's machines?

Answer 1

These rules are entirely useless on developer machines.

They are supposed to prevent new executables from being executed. It's not just a side effect, it's the entire security concept. Work around that, and the security concept collapses.

You can simply not use such safeguards on developer systems. Developer systems must be treated as untrusted zones in any corporate setup, with the fundamental assumption that you can not contain any malware inside.

Your students will copy& paste source and scripts from the internet, and inevitably compile malware locally, sooner or later. No signature nor rule based security concept can protect you from that.

So not let these machines access sensitive areas without strong authentication, perform proper isolation of network segments and have a good strategy for resetting system images (and use it frequently!).

But forget about as much as the idea of keeping a developers machine safe from the inside. It simply doesn't work.