controlled folder access blocked from making changes to memory

With Controlled folder access, certain directories can be designated as being 'protected,' with certain locations, such as Documents, being compulsorily protected.

Microsoft's attempt to combat this is called 'Controlled folder access,' and it's part of Windows Defender. In other words, if you can read and write your own documents, so can any ransomware that you run. The risk with ransomware comes not with another user changing all your files (by encrypting them) rather, the danger is that a program operating under a given user's identity will modify all the data files accessible to that user identity. But the rise of ransomware has changed the threats to data. The long-standing approach is also reasonably effective at protecting the operating system itself from users. On multi-user systems, this is broadly effective: it stops one user from reading or altering files owned by other users of the same system. The long-standing approach that operating systems have used to protect files is a mix of file ownership and permissions.

In addition to the richer control over exploit mitigation that Microsoft announced earlier this week, the new build also includes a trial of a new anti-ransomware capability. The latest Windows 10 build, today's 16232, contains a few new security features.

Controlled folder access blocked from making changes to memory