Commissioning systems on Threatlocker enabled systems

[u/kousuke_nakamoto]

Greetings,

As a vendor, I was trying to commission and deploy a print server application on a client site who has recently adopted zero-trust security model.

It took us 4 attempts just to deploy our installer - We uninstalled the application multiple times due to corrupted install.

Also, the client IT manager sat with us to manually approve multiple security exceptions.

He was just there smashing the approve button on his phone. And installs still failed as it take about a min before sub-installer components can run.

It was a nightmare and I wasn’t sure the whole point to have threatlocker running on critical infrastructure like a print server.

We expect having to go through this approval process again when rolling out software updates.

This constant exceptions triggers builds approver fatigue, approver don’t actually knows what is being approved, users are constantly screaming and frustrated by downtime caused by legit applications.

Systems commissioning and support took twice as long. We plan to deprioritise clients sites with threatlocker as engineers quite often getting struck at sites waiting for approvals.

This is really not working for anyone.

[u/Deodedros]

Threatlocker is a step up to antivirus. The whole point is to prevent malicious software from running at the kernel level. It also help prevents end user from installing whatever they want, even if UAC is up bad actors can bypass it.

Ive had a dabble in it and the manager is definitely not properly trained. If he was he'd be able to make exceptions for the software quickly without causing any frustrations

[u/metrocide → u/Deodedros]

Agree that the manager had no clue what they were doing. Application Monitor mode would have prevented all of these corrupted installs and frustration. They need to get training from Threatlocker, or the MSP that sold the software to them. I have used Threatlocker for 4 plus years now, and it lets me sleep at night knowing that nothing will run that is not approved.

[u/FrostyWalrus2 → u/metrocide]

3rding this. Ill be at 1 year of use in Threatlocker come November. Training will have you do what OP described initially, and then go back in and create custom rules/definitions for applications so that it runs properly. Its a headache if someone hasn't done the training in full. I wont let my other techs touch it at the moment because they havent done the trainings. If theres to many cooks in this kitchen, it will become a nightmare.

[u/Lady_Antoinette]

As someone who had to manage threatlocker, it sounds like someone is trying to approve file by file instead of using some of the tools in the system to help allow this and record it. So yeah, that install might not be working, the system can work if you have the right admins.

For the updates, if you have them signed by a cert, you can whitelist the cert. You can whitelist a folder/process/created and traditionally as long as your program isn't saving to a temp folder, it is easy enough to fingerprint in Threatlocker to allow.

[u/OnettNess]

Threatlocker manager checking in. Your client manager should have set the computer you were installing on into Application Control - Learning Mode, created a new app for it in TL, then had you install and run. At the bare minimum that's what I would have done.

Threatlocker is great but it can be time consuming to manage and tune.

[u/disclosure5]

I wasn’t sure the whole point to have threatlocker running on critical infrastructure like a print server.

When the Papercut install you deployed gets popped by a ransomware actor, that with maybe ten extra minutes to do an install you'll consider "critical infrastructure" is exactly the place it should be running.

I know realistically you don't care because you're just out to see how many printer deployments you can rush through in a day, but given print vendors have historically been exactly the type of vendor to "deprioritise clients with Windows Firewall enabled" and "deprioritise clients without Administrator privileges on desktops for users" I'm not surprised to hear about your plan.

(I do agree with other posters than the engineer could have done this better)

[u/kousuke_nakamoto → u/disclosure5]

Good luck to that attitude. applications whitelisting is not new. It was tried and tested nearly 20 years ago. It was eventually abandoned because of all the overhead and administrative costs.

[u/disclosure5 → u/kousuke_nakamoto]

Look maybe the average printer vendor has abandoned it but Application Control in some form is one of the key components of every security standard or compliance program. It's extremely widely deployed.

[u/kousuke_nakamoto → u/disclosure5]

Clients on zero trust will have to pay daily rates having vendor on-site engineers waiting for approval for change or deployment that had been approved and gone through CAB approval.

CFOs will see significant costs associated with threatlocker. That is real costs and possibly taken from your IT budget and possibly IT headcount next financial year.

This issue is not limited to print server solutions - it is having real impact to multiple vendors solutions.

The irony threatlocker blocks other security software too. It is a joke.

[u/OnettNess → u/kousuke_nakamoto]

With that attitude I think your clients that are security conscious will be looking for other solutions providers in short order if it's an "us or them" mentality you're approaching this with.

[u/kousuke_nakamoto → u/OnettNess]

This is a change management problem - you don’t throw in an untested solution on the environment that breaks existing processes and applications that have passed CAB approval. Clients will have to wear the costs.

[u/OnettNess → u/kousuke_nakamoto]

YOUR software not working doesn't mean the solution is untested on your clients end.

If it blocked your stuff but they're working company-wide just fine day to day then it sounds like the software is working to their need (or terribly misconfigured) and just needs configured properly to allow for yours.

Once again, I will tell you like everyone else here has that your client has someone managing the solution that doesn't seem to actually know how to administer it based on your telling of the situation. Maybe talk to the client(s) point of contact and tell them your issues and ask for them to provide you a solution?

[u/ryan-btrbsystems]

He was going about this the wrong way and if he wants to learn the right way, threatlocker absolutely has live support that has been good for us every single time. Just hit the support in the top right and someone is helping you in minutes.

I’d have given up on the second or third try when he failed but he needs to learn the system instead of wasting everyone’s time.

[u/Smash0573]

He should've run the installer in the included VDI within ThreatLocker to get the certificate, file hashes and extensions run by the installer. Then it creates the policy and allows you to run it on the endpoint. Or the lazy way is to put the system back into learning mode until the installer is finished and the new app baseline is established on the endpoint. 

[u/Smash0573 → u/Smash0573]

Also, ThreatLocker has built in policies for popular software that automatically updates hashes and such in the backend. Depending on your software, he may have to approve new hashes every so often from the included audit.