Application whitelisting can stop malware your antivirus misses. Dr. Mike Saylor joins us once again to explain why almost nobody does it, and how you can.
There's a malware campaign called SocGholish that's been around since 2018. It pops up a message telling your users their browser is out of date. They click to update, and what they download is a dropper built just for them. Every copy is different, so a pattern-based malware tool isn't going to find it.
So what does stop it? An approved list of software, where nothing else is allowed to run. I asked Mike point blank whether application whitelisting is a silver bullet for preventing malware, and told him if he said "it depends," I was ending the episode. You'll have to watch to hear his answer.
The catch is that almost nobody does it. Mike walks through why: you have to inventory every application in your environment, sit down with everyone to figure out what's legit, decide who pays for what, and build a process for when Bob in accounting needs something new. Then someone has to own that list forever. Politics and overhead kill most of these projects before they start.
We also get into the simpler option, which is not letting users install software at all. It's easier to turn on, but it creates the same gate, and you'll hear from every engineer and VP who thinks they need an exception. Prasanna asks whether AI could take some of that friction away. Mike's answer is one word.
Other things we cover:
🔒 Microsoft AppLocker and EDR policies
📱 Company-owned phones, BYOD, and MDM
📂 Blocking executables in temp directories and user folders
📄 Office macros and users who click through every warning
🔍 Running your whitelisting tool in audit-only mode so it builds the inventory for you
🤖 AI agents with access to your laptop, and a new phishing campaign called CoSnitch that targets Copilot
I also tell a story from 30 years ago about a boss who wanted me to install Perl in violation of bank policy. Let's just say it didn't end well for him. The point is that none of this works without support from the top. Someone will always think they're the exception, and senior management has to be willing to say, "You're not that special."
If you're an admin wondering whether locking down software installs is worth the fight, this one's for you.
Chapters:
0:00 Intro
1:30 Welcome, Prasanna and Dr. Mike Saylor
2:37 SocGholish and fake browser updates
4:57 How often do companies really whitelist?
5:18 Inventory, licensing, and exceptions
7:08 Shadow IT and the $30 NDA
10:08 Who actually does this
11:01 Politics and overhead
12:12 Just don't let users install software
14:37 AppLocker and EDR policies
15:47 Can AI reduce the friction?
17:08 Layered responses to a single threat
18:47 Office macros and click-through users
20:49 Is whitelisting a silver bullet?
21:29 Signatures and the ideal whitelisting process
25:41 Mobile devices and MDM
28:44 Temp directories and executables
31:55 How do you learn what you don't know?
33:19 Audit mode as your inventory
35:05 AI agents, integrations, and CoSnitch
38:07 Good, better, best
40:33 The Perl story
43:21 Final thoughts
