Application whitelisting best practices can stop malware your antivirus never sees coming, but almost nobody follows them. Dr. Mike Saylor joins Prasanna and me to talk about why, and what it really takes to build an approved software list that sticks.
We start with SocGholish, a fake browser update campaign that’s been around since 2018. Every download is built just for the victim, so pattern-based tools can’t spot it. That’s exactly the kind of threat an approved software list shuts down.
Then we get into the hard part. You have to inventory every application in your environment, figure out who needs what, decide who pays for it, and build a process for exceptions. Mike explains why politics and overhead keep most companies from doing it. He also explains why shadow IT means your procurement process probably isn’t catching what you think it is.
We compare whitelisting with the simpler option of not letting users install software at all. We also talk about AppLocker, EDR policies, Office macros, MDM for mobile devices, and blocking executables in temp directories. Prasanna asks whether AI can take some of the friction out of software approvals, and Mike gives him a one-word answer. I also share a tip that makes the inventory step a lot less painful: run your whitelisting tool in audit-only mode first and let it build the list for you.
We wrap up with the good, better, best versions of this control. I tell a story about an old boss, Perl, and a bank policy that ended with him getting fired. And there’s a reminder that you will always need support from the top. Someone will always think they’re the exception, and senior management has to be willing to tell them they’re not.
If you’ve ever wondered whether locking down software installs is worth the fight, this episode is for you.
Chapters:
00:00:00 – Intro
00:01:30 – Welcome, Prasanna and Dr. Mike Saylor
00:02:37 – SocGholish and fake browser updates
00:04:57 – How often do companies really whitelist?
00:05:18 – Inventory, licensing, and exceptions
00:07:08 – Shadow IT and the $30 NDA
00:10:08 – Who actually does this
00:11:01 – Politics and overhead
00:12:12 – Just don’t let users install software
00:14:37 – AppLocker and EDR policies
00:15:47 – Can AI reduce the friction?
00:17:08 – Layered responses to a single threat
00:18:47 – Office macros and click-through users
00:20:49 – Is whitelisting a silver bullet?
00:21:29 – Signatures and the ideal whitelisting process
00:25:41 – Mobile devices and MDM
00:28:44 – Temp directories and executables
00:31:55 – How do you learn what you don’t know?
00:33:19 – Audit mode as your inventory
00:35:05 – AI agents, integrations, and CoSnitch
00:38:07 – Good, better, best
00:40:33 – The Perl story
00:43:21 – Final thoughts
