Application Whitelisting Best Practices: The Silver Bullet Nobody Uses

What one practice could stop all new malware from getting

installed in your environment?

Today, Prasanna, Dr. Mike Saylor, and I, uh, talk about application whitelisting.

We first start by talking about a, uh, an attack that tricks you

into installing malware into your environment as a fake browser update.

And unfortunately, a pattern-based, uh, malware detection tool wouldn't spot it.

So we talk about what it takes to create an approved software list, the

inventory, the politics, the exceptions, and the VP who thinks they're special.

We also talk about audit mode, why your users shouldn't be able to

install software anyway, even if you're not gonna use whitelisting.

If this is your first time watching or listening to me, I'm W. Curtis

Preston, AKA Mr. Backup, and I've been obsessing about backup and recovery,

and now cyber recovery, for over thirty years, ever since I had to tell my

boss that there were no backups of the database that we had just lost.

Now I've written five O'Reilly books, a blog, and this podcast.

Here, we turn unappreciated admins into cyber recovery heroes.

This is the Backup Wrap-Up.

Welcome to the Backup Wrap Up.

I'm your host, W. Curtis Preston, AKA Mr. Backup, and I have with me

the only reason that I remembered to press record, Prasanna Malaiyandi.

How's it going, Prasanna?

Good, Curtis.

Remember some of the previous times that we've forgotten to hit record and

Dude,

minutes in and it's

we've recorded

we technically didn't record at that point, but yes.

It's very depressing.

You're like a half hour in and you're like, "We didn't press record." And

you did let… And you're always like, it's like the fish that got away.

That was some of our best work, right?

then you realize never to be seen, the missing episodes,

Yes

speaking of missing, we got Dr. Mike Saylor.

How's it going, Mike?

Doing well.

Glad to be here with two guys that still appreciate the value of good haircare

It's a beautiful thing.

Or at least half of me, values that.

and, of course, Mike is the co-author of my, latest book here, Learning

Ransomware Response and Recovery, available at a book retailer near you.

and, I want… Before we start this, week's episode, I just wanted

to, just talk about, there was a, there was a, an attack chain

that's been out for quite a while.

Mike, you said, eight years, right?

2018 is

Yeah.

Yeah, it's, yeah.

So it's called Sockghoulish, or also known as fake updates, and it's a

JavaScript-based malware, and it tricks users into downloading malicious

files by basically saying things like, "Your browser is out of date," right?

And so you click here to update.

you click here to update, and of course, it, the update is, a fake executable

that is then, the, the only job of that update is to be a dropper, and then to

establish presence, and then download the a- or download the actual, malware, right?

The real problem is that this code, the reason why it was so malicious

is that each executable that was downloaded was essentially created

just for you, which is a term you go a lot into in the book, Mike, the,

this idea of polymorphic ransomware.

You wanna talk about that real quick?

Yeah, polymorphic, in, in general terms, polymorphic means it continues to change.

It's the same thing,

different.

Yeah

and w- and what that means is that a typical pattern-based system

that's looking for, typical malware isn't going to find it, right?

and so the only way you're going to stop something like that is to do what

we're talking about in this episode.

Now, I will say that, b- and we're talking of course about

application whitelisting, okay?

But wait

What?

I don't think it's the only way, and I will constantly say

this in every single episode.

Okay, go ahead, Prasanna

y- you know how you prevent these things from happening?

Go ahead

you disconnect yourself from the internet

Sure.

That,

I'm just saying that is always…

a way.

Yes.

there are, there are other similar te- not similar to that, but you can also

do things like not allowing people to install and execute their own code, right?

that is just an period, right?

But this idea of application whitelisting, which we're gonna talk about, definitely

something that people talk about.

I don't think a lot of environments do it, and I'm curious, Mike, a-

as a blue team person, how often do you see people doing whitelisting?

Very often.

Oh, very often.

Okay.

Wait.

Oh, not very o- Oh, okay.

I missed the not part there.

the not was very important and I missed it

and because it takes work.

So the first thing you have to do is inventory your, the

applications in your environment.

I'm already bored

and then you have to w- you have to sit with everybody to determine if

it's a valid and that, it's trusted, it's supported, it's licensed.

and then from there you've gotta determine, what's the

use case to support that?

and there's economics behind it, right?

So if we're gonna whitelist this Adobe, does that mean everybody gets Adobe?

And, how much does that cost?

or, just this one person, it's a single use thing, right?

Do we need to really buy a whole license because you need it for this one project?

then, all right, so now we've got this approved list.

Someone's gotta manage that.

And then not only the approved list and the updates, but

what about the exceptions?

So now Bob in accounting needs some other application.

What's the process for that?

it just for Bob or is it for all of accounting?

Is this an exception or should we add it to the list?

So it's, it's, it's a significant change both from a maintenance, IT management

maintenance perspective, but also culture.

you've gotta have a work environment that, that supports restrictions

But Mike, everything you talked about totally makes sense, and I get from

an IT perspective it can be painful.

But isn't some of this already, required?

As an example, when Bob needs to go procure that one piece of software

he needs, he's probably going through some process already today, right?

Or when you're licensing out, Adobe to different people, right?

You're not overbuying, right?

They're probably giving you some justification, something else,

and it's probably going through, finance or some other system, right?

And outside of IT itself as well, right?

You, you would think.

so in well-established environments, you're

you naive little person, Prasanna

There, there are procedures.

We will follow these things.

But then we also have what we call s- it's shadow IT.

It's

right?

stuff without involving the authority, over technology, which would be the IT

department or at least your manager.

So they're… They can't get approval for Adobe, so they're like, "You know what?

It's only however much.

I'll just buy it myself," or, "I'm going to school as a student, so

I've got free access to Adobe Cloud, so I'm just gonna install it on my

machine." That happens all the time.

Yeah.

And I…

it often

ahead

depends on their relationship with IT is not easy to work with, people will

often circumvent that, that interaction

Yeah, I do remember a previous employer where the, the policy was that is exactly

what you said, Prasanna, that you had to go through a procurement process.

You were not allowed to install, software that was not, that was not on,

that, that had not gone through their vetting process, which as I recall,

involved a mutual NDA signing, which was always fun with a new vendor, right?

d- you're gonna… This particular company, they wanted a, a full NDA

between the two companies so they could buy a $30 piece of software.

it was, know, you talk about easy to work with.

The… A- and yet, the same company is the same company that we interviewed

that told us that they had 400 SaaS

Cloud applications.

Yep

in, production.

And, so yeah, so I… The, the, so you said, Mike, is true, right?

The, the real problem starts with the, you have to first, before you do

anything, you've gotta do this inventory.

And it's just it's so many other things that we talk about, that A, you ha- it,

it has to come from the top down, right?

and it ha- you have to have support because you will ultimately get pushback.

I literally j- I just finished e- editing an episode where you talked

about that the problem is that you get to that, you get to that, that situation

where some part of the company is being inconvenienced, and then they're like,

"Oh, turn this back on." And you're like, "Okay, I like my job more than I like,

doing it correctly." And so they, so you just, you end up giving in, right?

And so it's a lot easier not to do this, but it's just it's also

a lot easier to develop a backup system or a DR system without

collecting any requirements, right?

It's very easy to do that.

everything and keep it forever

Yeah, exactly, right?

and and

what we're talking about here is a best practice.

I'm curious, you said you, you don't see it very much.

Do you see it in any particular type of companies, perhaps

highly regulated, companies?

Regulated or, I was gonna say regulated or publicly traded, or

those preparing to be acquired.

They've gotta want to, they wanna look good a due diligence perspective.

So yeah, it's those that, that, wanna be perceived or graded, as,

having good hygiene and good controls

But Mike, w- like, why is this such a problem?

there is a lot of benefits for understanding, what's out there,

if there are vulnerabilities, and, what people are using out

there, what even the licenses are.

Maybe you have three different things which are being used for photo editing.

It's like, do you really need three…

to pay for three separate license packages for the same thing

from, a cost savings perspective?

Like, why is it such, like, taboo or so difficult to just go and

be like, "Hey, I just need to know, what you're using and why"?

Politics and overhead.

So the politics part are, that's the, we are gonna govern you, some companies,

population don't wanna be governed.

so yeah, it's none of your business what I'm running on

my laptop, what I need to use.

so politics is probably the biggest one.

The, and either tied for or in second place would be

bandwidth, resource bandwidth.

So now somebody ha- this has gotta be somebody's job to manage this.

It can't just be a… it can be a point in time thing justify the need

for ongoing management of it, but if you're gonna implement whitelisting,

that's gotta be part of someone's job

I'm gonna assume, I think this is gonna be correct.

can… Let's say we can inventory, we can start somewhere where we

can say we're going to do this person, or this department, and we

can turn on this whitelisting only on the computers that they use.

We should be able to do that, right?

Yeah.

yeah.

more complications, Curtis, and now you're gonna have to worry

about one person versus another and

yeah.

the, but the problem is… Go ahead

thing to do is don't allow users to install their own stuff.

You mentioned this as a mitigating control for getting malware.

if the profile I'm using, I'm logged in as, doesn't have the ability to install

stuff, whitelisting, though it's still important, there's a lot of value,

you alluded to some of them, cost and license management and all that, but

also backups and patches and… But if I can't install stuff as a user,

then the stuff on my computer should only be there because IT put it there

Mike, how long does that last before some engineer somewhere goes and complains

to a VP that, "Hey, I was not able to ship this feature or do my job because

IT said I can't install something"?

And by the way, yeah

there's always, exceptions.

And by the way, management is usually also one of those exceptions.

management wants to be able to install stuff whenever they want.

you saw that in the military a lot too.

But, engineers, or developers, a lot of their tools require them to be able to

run as admin to make full use of resources on their computer and that kind of thing.

So obviously, there's gonna be a, there's gonna be an exception

for different types of users

It's- I'd say that,

of software

I'd say that these two methods, the idea of, turning off the ability to

install your own software and developing a complete list of approved software,

I'd say the f- the, the, the turning off the ability to install software is

probably easier, and yet they both have challenges to the environment, right?

you talked about… So the, 'cause the problem, it's pretty easy to push out

a, to push out an update that sa- that says, "Nobody's allowed to install

their own software anymore," right?

Only administrators can install software, and also you'd have to

change it so that everybody… 'Cause

Do it

I've been in, environments where said only administrators can

install software, but then they make everybody administrator, right?

the problem with that is now every time I need a piece of software, I

have to go to IT, which is the same effect the whitelisting, right?

Except that it's just a different, it's just a different process, right?

Different gate.

Yes.

It's a different gate

yeah.

a very similar, result.

So l- let's just talk about, so if we were going to do this, there is a tool called,

Microsoft AppLocker, and there's also, you've got obviously EDR policies that you

could push out assuming you… obviously this has to start with having an EDR

tool pushed out to every endpoint, right?

we can either establish policies there or we can use something

like Microsoft, AppLocker.

Do you know if there's a- an equivalent in the Mac world?

No, it would have to be some kind of middleware,

Yeah

thing, a Samba-type middleware

and

can I go back?

Can I go back?

Yeah

Okay.

So I have a question.

So we said that people can install app, or with the first option, not

the second option where you whitelist, but the first option where you don't

allow apps to be installed, right?

And then this causes difficulties because then they have to reach out to IT and

ask and everything else like that.

And I get that a lot of IT departments are overwhelmed with everything else

they have, and so lead times are long.

Do you think with sort of a lot of the AI tooling that's out there, that a

lot of this can quickly be automated, applying company policies, et cetera,

to reduce some of that friction while still ensuring that there is some level

of scrutiny, protection, et cetera, on what someone may be installing

on their device without requiring the full application whitelisting

that Curtis was just talking about?

No.

What?

say no.

The, the less, privilege you give a user, the more secure you're

gonna… that endpoint's gonna be.

even with AI, we allow AI to determine if installing this thing

is okay, you're still relying on the current knowledge of that AI.

That could still be a bad software or have a vulnerability that

introduce, it's introduced to that endpoint or that, that environment.

or it conflicts.

you're installing something that's gonna make something else stop working.

AI's not gonna be fully aware of all those things.

and, it could be a legitimate application, but they're downloading

it from an illegitimate site.

If I could interject very quickly.

going back to the SOC Gaullish attack vector

that, that attack campaign is designed at trying to phish users into

installing an update to their browser.

The way that comes in, obviously, if we're blocking a user profile's

ability to install stuff, good, that mitigates the threat.

But if we don't, activity that malware takes is it uses the Windows

default application, registry for a Java file to open it with Notepad.

That activity is then what spawns other stuff.

And so understanding… So we're getting-- where I'm going with this is understanding

the particulars of a given threat and how it impacts your environment will drive

both administrative and technical policy.

So administratively, we need to block people from being able to install stuff.

Technically, we need to change the way Windows and Mac machines open

Java files as an… So just as an example, I wanted to bring that up.

There's more to-- There, there's not one… there's typically not

one answer to a given threat.

It's truly understanding the threat to realize potentially a multitude

of things that need to be done

There's, there, there are, there are a number of types of files that, we have

to be d- d… I think this is a very interesting episode because we barely

yet, we barely started talking about actually doing application whitelisting.

We're talking about everything else.

but the, like for example, educating users that they should not be

opening Microsoft Office files with macros enabled unless they're the

ones that created those macros.

that in general, like everyday average users d- I'm j- I'm gonna say

everyday average users don't create documents with macros in them, right?

It's only like power users that are doing that.

So you should have that

other people's documents that have macros in them.

Yes, and those macros can do the kinds of things that we're talking about.

What was that?

do they even know what a macro is?

Yeah, they don't.

And again, this

I've gotta get this file open.

I'm just gonna click through all these pop-up messages until I

can look at this spreadsheet."

Yeah.

and that's probably another thing that we can disable

Yeah, disable with a policy.

I, I-- when I say a policy, I mean a, I don't know what you would

call it, like a registry entry, not, I don't mean just an IT policy

and a lot of organizations today deploy their Office software

from Office 365 licenses.

And in

Right

365 tenant, you can change settings that filter down to all of your users.

So the next time they're on the internet, they're getting that policy

update across all their locally installed Office applications.

if, like just today, I opened a document and across the top it, it

gave me a yellow bar, a l- a yellow banner that I had to acknowledge

if I wanted something to happen.

And so a normal user is just gonna go, "Whatever," click, and

Yeah.

the banner.

Yeah

"How come I can't edit this field? Oh, it's that banner," click.

and so it needs to come with awareness and training too

Yeah.

I th- I think that's true of all of this.

All right, I'm just trying to think.

all right, let's get back to the topic at hand.

whitelisting

application whitelisting.

Or allow listing, I think

yeah, I do think it's a bit of a silver bullet in that, if you, if no one can

install applications that aren't on this approved list, and that's stopped

from a, both a policy and a, and a technology perspective, it is a bit of

a silver bullet for preventing malware.

Yes or no?

If you say it depends, I'm ending this episode

It is a bit of a silver, silver bullet, yes.

Okay.

All right

silver bullet

Okay.

W- wow.

I, I, that sounded not good, 'cause I know what a .22 caliber bullet is.

Anyway, is it a .22 caliber rifle bullet?

but when you… So I have a question about the technicalities

of application allow listing.

Yeah

you allow list an application, say it is Adobe, and your IT policy says, "Okay, we

will allow Adobe to be installed," do you specify where that Adobe can be downloaded

from, what version can be downloaded?

Or is it just saying, "Here's an Adobe executable," maybe there's a signature

attached to it that was generated and therefore only that Adobe installer with

that signature is allowed to be installed?

'Cause I'm just going through my mind and thinking like, say, like

the use case you brought up, Mike.

walk through the, if

Yeah.

through the ideal

Yeah.

of whitelisting

Company policy that says we're gonna do it.

So management approved, management supported.

We've now got a policy and a procedure approved by management.

We take an inventory of all of our assets.

We go through the analysis of what we want, what's approved, what we don't

want, and what the exceptions are, right?

So we do that

from that list, now we can build a baseline too.

So what does everybody need?

We'll put that in our build images.

What is a department or a user need?

And we'll make that available for that user.

In our policy, we are going to define that users cannot install their own stuff.

So we're not gonna allow them to go out and install what they think is

the right or approved or safe version of some software on the white list.

means they can ask us to do it, or we'll pre-build it when they

get hired or that new device.

All right, so now we've got this inventory.

That inventory is then gonna be aligned with our patch management

policy, on the Windows side and what, our current tools can patch

from a third-party tool perspective.

what… And then identifying then, what else do I need to subscribe to make sure

we're up to date or current on updates and patches available to the other software?

So there's the management part.

right.

then where is the data stored for these different applications?

Is it a cloud-based?

I've got to log into it through a, a browser?

so there's a local client or license, but where's my data?

Is it stored in the cloud?

Is it stored locally?

What folders are my, are my related data stored in?

And that needs to be incorporated into our backup policy, especially if

it's some critical process or user.

All right, then how do we recover?

A particular application, if it becomes corrupt or, we need to migrate that user

to a different machine, what's our process for migrating a license or the data?

So there's that whole incident help desk perspective.

then on the back end of that, from a support perspective, Curtis calls and

says, "Hey, I'm new here," or, "I've been here for a while," either case,

"I need this software." Is that… how do we get that software to Curtis?

Is that a ticket and we remote in and install it?

Do we have to show up?

Or can I give him a link now he's got access to an approved location repository

or the website itself, to pull that down and either, if he's not restricted to do

so, he could install it or let us know when it's there and we'll take care of it.

And then there's the automated way of pushing it out through Microsoft tools

that can do batch processes and stuff

Yeah.

w- what I didn't hear in there was one part of what Prasanna said is this idea

of there being a signature for each of these tools to make sure that whatever

does get installed is the version that we had intended to be installed.

can that be part of it?

It is, and that's, that would, I didn't speak to it specifically, but the known

trusted locations or versions of software.

Right

right now we're speaking specifically about, PCs and laptops.

You would wanna do the same thing with company-owned mobile devices.

You can create a company store account in the Google and, Apple stores and define

the applications that are acceptable or approved, or you can use a mobile

device management solution, and that software gets installed on the device,

and then it usually has its own play store for approved applications that can

Yeah, I've seen that, that second one very commonly again, because it's still, I

think, tell me if you've seen differently.

What I've seen more common is that users are allowed to bring their own devices,

but in a, an environment that carries very much, they put an MDM solution on

there so that any company data stays within that, particular, virtual area.

Prasanna, you look like you wanted to say something

yeah, and, Mike, I'm glad you brought up the mobile aspect.

Do you feel that application allowlisting is more accepted on

mobile devices than on, PCs and laptops from a user perspective?

Do you see that being more common than

for company-owned mobile devices, you kinda don't have a choice.

and I don't remember hearing much complaining about that because

it's your company… You've still got your personal device.

The company device is for company stuff.

But if it's a bring your own device, and then we're gonna restrict you from

what you can install, then they're just not gonna use it for company

Yeah.

rather have autonomy on their personal device than being able to get email

on that device and not being able to

Yeah.

and I think,

it… S-

oh

Prasanna, but that's where the MDM comes in, right?

So that basically anything company-wide stays within that

bubble, and you can do whatever you want on the rest of your phone.

Is that…

But what

That does solve that issue, Mike?

Yeah.

But Mike, more specifically though, why are people okay with corporate

devices having this allow listed, application, that they're allowed

to install, versus why is there so much pushback when it comes to like

their laptop or their desktops?

Like it seems like they, they're both company owned, right?

And so why is it okay for

you, don't have your personal laptop in your pocket or… So you don't have your

home computer with you all the time.

You've got your personal phone with you everywhere.

So if you can't do what you want on the work phone, it's okay,

I still have my personal phone.

But if I can't do my personal stuff on my laptop, I don't have

my personal laptop with me at work.

So it's

Are you suggesting, Mike, that some people do personal stuff on their work laptop?

I

Say it isn't

102% that everybody in the world has done personal stuff on a company laptop

Yeah.

so one thing we haven't talked about already, a- and this would, this fits

very much into the same, world, is not just limiting… And again, these

are all choices that you can do.

you do one, one, all three of them, whatever.

But one thing that we haven't talked about is the idea of definitely

cannot install applications in, temporary directories, right?

because that is what these, these drive-by, malware, I, I, the word's

not coming out right, but this is what these are, these… But dang

it, finish my sentence for me, Mike.

You know what I'm trying to say

those are the tactics of drive-by malware

you

some of these, these phishing tactics.

They're- they've gotta put the dropper file in, a place that the

system or root, would be able to pick it up without conflicting

with the logged in user profile

W- we don't let them do it in temporary directories.

Can we also say don't let them put executables in their personal directory?

Would restrict users from doing anything with executables,

like a true EXE file for sure.

but then depending on the capabilities that you have, even Microsoft

Defender, which, it comes with Office 365, has some capabilities of

limiting activities, across different folders in a Windows environment.

Certain computers have BIOS settings, like tr- TPM settings.

then, on top of that, Windows has the ability to lock down critical folders.

This is just a setting.

It comes with every, every Windows All right, then on top of that you

have an endpoint protection solution, whether that's Defender or something

more, more capable like Huntress.

now we have policy.

and so just putting layers… And that's the key to all of cyber is layers.

Oh.

Those policies can then extrapolate behavior based… and some of these have

AI built into them, like Huntress has AI, so it'll sandbox and look at behavior.

And so at the fundamental level, everything that we use today has settings.

You just need to go learn about them and how to use them.

And then for those environments where you wanna mitigate risk further,

we'll start looking at technologies that you can put on top of that.

a lot of them are affordable, but they all start with what does

this user need to have access to?

And that's, that includes what we've been talking about here

with application whitelisting.

Write a policy for that.

Users don't need to install stuff.

But then, all right, so can I tr- can I turn this Windows security

feature on so that a user can't go double-click into the system 32 folder?

A user can't install stuff into a, a system folder.

A user can't execute, or download or take action on an executable file.

That's all

Right

gotta work that at the company cultural level first, and then the technical level.

But Mike

there, there are a lot of ways that you can prevent malware

from triggering in a workstation

So it seems there's so many different settings, but you need to know they exist.

If I'm an IT person and I have no idea these settings exist, what do I do?

Do I just give up and curl up into the fetal position because I'll

never be able to do all these things?

how do I know what I don't know, right?

Or how do I learn the things I don't know?

I use a phrase I learned from Ken Shamrock back in my ultimate fighting days.

He would say… So he would ask you a question and you're like, "I don't

know." He would go, "You don't know?

You better call somebody." And that's re- and that's really the point.

You don't have to do this alone.

And this, and there's no way you could, 'cause you could be a Microsoft expert

today and, or I'll say last week because they pushed out some changes this week,

and you're like, "What the heck is that?" But there is free training as an

admin in the Off- Office 365 portal, and there's also free training for users.

But you know what?

Nobody knows it's there.

so as an admin, go to your admin portal, look for the training, take the admin

training, and in the admin training it tells you how to push out user training.

That's also free.

But, especially in the US, we're such a society of we've gotta have

the latest and greatest and we need it now, and we're just gonna turn

it on and we'll figure it out on the fly, without reading the instructions

Yeah.

turtas,

the way, but bef-

turtas

Oh.

I was just gonna say that, that one, one thing we haven't talked about, if

you're going to consider implementing a whitelisting, tool, one of the things

that you can do is you can implement it in audit only mode, so that it

can see what is currently being run.

And you could run that as long as you want to.

You're like, for an entire year, these are the applications that have

been running in this environment.

there's no harm in turning that on, right?

and so you could, y- you could start with that as your inventory.

You don't have to do this, this big giant meeting thing.

You could, you just run it and let it collect that information for you.

I think what's gonna happen if you do that, you're gonna find 17,000

applications are running in your environment, and then you're gonna…

At least you can go in eyes open, right?

You can say, "Okay…" Go ahead.

a lot of them you don't even know about, like .NET and Java and

Yeah

there, there's all those kind of foundational applications that are

installed either by default or by some other app that needs that underneath it.

and maybe you don't need that app anymore, but you didn't install all the other--

you didn't remove all the other stuff too.

So that inventory is very eye-opening from a what I see as an icon on my

screen, but all the stuff that those apps need from a framework perspective.

You can use that then to go and talk to management.

"Look, this isn't just about risk, it's about cost. about licensing and

support and patches and backups and user happiness and all these great things."

do we care if the users are happy?

than what the IT help desk does

That's true.

I, I d- a related topic that I thought I'd bring up here right at the end is

there's a new of tool that's available to us, tools like CoWork, right?

Where we have this, this AI tool that we're using, and now with a few mouse

clicks, I can give, my AI, my favorite AI tool the ability to do stuff on my laptop,

and it's gonna be executing via the same APIs that I'm already using, right?

So I just authenticate it with, I'm a Google person, so I authenticate it with

Google Drive and with Gmail and whatnot.

then, I don't think… I don't know how you would stop or

even know that's happening.

D- do you know, Mike?

if it's connected or integrated with your environment, especially Office 365,

you'll see those, those integrations.

right.

Yeah, yeah, I g- I guess I was thinking it from, a company perspective, right?

But you're right.

If it is a company, gonna see that in the integrations tabs

of the, of Google, right?

or whatever it is you're using, like 365

Just recently, in fact, I'm in the middle of writing a threat brief

right now, that there is a, there's a new threat approach called CoSnitch.

So it's a phis- a phishing campaign where a user would interact with his

email, and once you do, it deploys code that will give third-party threat

actors access to your personal Copilot

Oh, wow

Yay

That's scary

So in a company environment, you've got Copilot Personal, the unlicensed

enterprise version, and then the

Right

Enterprise version.

Both of them have been patched as of, I think, Friday.

But anything that happened… So this, this attack's been

around for a couple of weeks now.

So if it, if they phished somebody last Monday, that integration

still exists even after the patch.

It just means it can't happen today.

Yeah

you've gotta go back and audit and the document, the threat advisory

talks about where to go look, but very similar to Your comment, Curtis,

you need to go look at those things.

And

Yeah

on a periodic basis,

I do know that, my last employer, they did… They were a 365 customer,

and they had a very strict, if you wanted to install something that

integrated with 365, it had to go to meaning IT had to, look at it.

You couldn't just install an application that worked with 365, which at least

they were… an app listing type… Or sorry, it's a whitelisting type,

What's SaaS?

I don't… Yeah, process.

Yeah, definitely.

There you go.

Sometimes the words just don't come to me.

all right.

So we've got a couple of different things that we talked about here.

we talked about not allowing installation in temp directories and things like

that, which I think is, a really strong thing that we should be looking at.

We talked about, and these are good, better, best.

would be just don't allow people to install software, period.

But realizing that turning on that, turning on the…

two, you're going to have a cybersecurity mindset in the company, and you're

gonna have to have support from senior management because there will… and

there will always be someone who feels they are more important than the process,

and that they should be the exception.

And you either have to have a process for that exception, or you have to

send them to senior management, and senior management have to say, "Hey,

you're not that special." so we either tell them to… they can't install

software, period, or we tell them that, let me… Actually, let me ask this.

If we're gonna do, allow listing or whitelisting, if we're gonna do that,

doesn't that, that automatically means that we're not allowing users

to install their own applications?

Or is what… Is it this is you do one or the other?

Yeah, I've seen an evolu- several evolutions of that we've defined… So

kind of the, the weak, diluted version of this control would be we've defined

a, an approved list don't misbehave.

audit this every now and then, and if we find you're in violation, there's

some kind of punishment for that.

and then there's the kind of the middle ground where, you know,

all the installations have to come through IT, but we still aren't

limiting you as, to a, a normal user.

You still have admin rights or what have you.

But the best, application list control would be, no privileged

access on the endpoint, for users.

a white list of approved stuff that we've already gone through, and IT

has to be the one to, to install it.

'Cause they're often the ones that have to procure it also.

And so that's gonna, that's gonna the risk of users buying their own

software, and potentially buying it from an illegitimate site

Yeah, I, I'm now flashing back to an employer many years ago

And we had this policy, right?

The policy was all software had to be purchased from an

established vendor, right?

Meaning, one of the ones that we're already doing business with.

And what that… That automatically precluded a, a lot of things,

which included things like open source software, if it was a very

useful of open source software.

One of the ones that I remember, again, this is 30 years ago, a really

op- a really useful piece of software that we wanted was NTP, right?

Because we had… None of the servers the same time as each other, right?

So we really wanted to do, use network time protocol.

we had a boss that… We got a new boss in our, meaning just my direct

manager, and he thought this was a stupid policy, So this is going back

to, you've got to have support, right?

So he thought this was a stupid policy, and he told me to install… He wanted

to install Perl, Again, great tool, but we couldn't purchase it from an

established vendor at the time, so it was therefore in violation of bank

policy, and he told me to install it.

And I said, "I'm not going to install it." and he said, he said, put in,

put in a, a request the software and see if we can get approval." And I

put in the request, and I put him as appro- I put him as the requester.

And he said, "Don't put me as a requester." I'm like, you're the one

requesting it." said, "Yeah, but if you put me as a requester, then I can't

approve it." okay, so you're telling me that I… That you want me to

request you to install this software.

Okay." so I… Then I'm like, requesting it isn't a violation of anything, so I

can ask for anything. So I'm like, "Fine.

You know what?

Fine." So I requested to install Perl, and I put in the line,

"So that all production…"

I said, "Re- request permission to install Perl in this directory,"

which was our primary file server, "so that all production servers can

access it." And then he approved

Tonight

and then I, and then he got fired the next day.

Anyway, this is what happens when you violate policy Anyway,

where were you going, Prasanna?

No, that, I was like, "Yeah, I'm pretty sure he got fired

yeah.

yeah, so you have to have support.

And in that case, I had support from on high, but I didn't have support from

down low And when you get that person that wants to do their own thing, you

have to have that support from on high.

If you've got a CEO who says, I'm not gonna do it," there, there's

only so much you can do, right?

Yeah.

Any final thoughts, Prasanna?

The… No, I know we get into these episodes talking about, what you could

do to protect yourselves, but then I also hear Mike talk about, yes, there

is the ideal, but a lot of companies and clients he works with may not

always be doing the best practices.

so I think for our listeners, it's just important to understand,

these are tools in your toolbox.

You are not gonna use everything all the time, but there are certain

scenarios that you should be using these tools, and just being aware

of it is useful even if you cannot implement it in your current environment

Yeah, I'm hoping that somewhere out there is an environment that never really

thought of how valuable the idea of, having an approved list of software that

only that software can be installed, that never really thought of that as

the incredibly powerful tool that it is.

and there's one person that says, "You know what?

We can do it.

We're only five people, and we're gonna do this for our company." then, then

we- then we've helped somebody, right?

So hopefully you've picked up something in this episode of some way

that you can limit the ability for users to just install whatever that

they want, which I think is the most common implementation that see, Mike?

That's what you see out there in the wild most of the time, right?

right

Yeah.

So if we can take, of our 25 listeners, if one of them, does that, then hey,

we've helped, fif- I can't do math, 4% of

Per person.

Yes.

Yeah.

Yeah.

all right.

thanks Mike.

With… and also, th- it was a, you limited the number of

it depends in this episode, but

I've r- I've really tried.

I will tell a story though.

go ahead

y- we were talking about exceptions and, to, to management, you're just a user.

I was at a FBI event, and I was listening to some local police chiefs

on a panel about how they dealt with, VIPs from the World Cup and traffic.

And so this, this VIP, his whole entourage, his manager, all this stuff,

had been working with the local police department, for getting him through

traffic from, downtown Dallas out to, another city, Arlington, where one of the

games was, and they were stuck in traffic.

because in a lot of cases, especially on the highways,

that's not city jurisdiction.

that's state or a federal highway.

So that's either Texas Department of Motor Vehicles or the State

Department of Transportation.

And, this chief was actually in the vehicle with this dude, this guy,

he's like, "I thought, you were gonna treat me like a VIP." He's like,

"I am treating you like a V- VIP."

He goes, "But I'm stuck in traffic." He goes, "Dude," he g- or he goes, "Man,

I can help you in the city, but when we get out on the highway, DOT just

thinks of you as just another dude.

You're just another dude."

That is funny.

Yeah.

was

I will again, say one of my favorite phrases is that

there's only two industries that refer their customers as users

Oh.

There's us and the drug dealers.

I'm just saying.

Yeah.

Anyway,

Yeah.

and with that, I will say that is a wrap.

The Backup Wrap Up is written, recorded, and produced by me, W. Curtis Preston.

If you need backup or DR consulting, content generation, or expert witness

work, check out backupcentral.com.

You can also find links for my O'Reilly books on the same website.

Remember, this is an independent podcast, and any opinions that

you hear are those of the speaker and not necessarily an employer.

Thanks for listening