David Cottingham

CEO & Co-Founder of Airlock Digital, practical and effective allowlisting

[Daniel Schell @danonit]

Video showing how @AirlockDigital prevents TTPs such as the DLL search order used to load an attacker controlled DLL into a trusted application from the compromised CPU-Z website last week.
https://t.co/u3q3ptN6AT

[David Cottingham @c0tts]

@Collab_Seth @AirlockDigital Anytime! I have been wanting to reply to this for months now! If I can help in any way, please don't hesitate to reach out to myself or support :)

[David Cottingham @c0tts]

@Collab_Seth @AirlockDigital Hi Seth, just reaching out here to let you know that our ARM supported agent is now GA in our v6.0 product release

[David Cottingham @c0tts]

@Collab_Seth @miketheitguy @AirlockDigital It's alive. We are now just updating the installer logic to accommodate. Still a few steps to go, but making great progress over the last few days.

[David Cottingham @c0tts]

@Collab_Seth @miketheitguy @AirlockDigital Thanks for the feedback Seth. It's compiled we just need to QA and ship it, will ensure it gets to you really soon. This really helps us prioritise.

[David Cottingham @c0tts]

Really exciting milestone to have the whole company together in Adelaide this week, cooking up the next chapter :)

[David Cottingham @c0tts]

Great to see another live @riskybusiness fantastic analysis as always

[Brian in Pittsburgh @arekfurt]

Application allowlisting is the future for all security consciousness organizations that have any significant resources.

It's just a matter of how and when any particular org will adopt it.

[Brian in Pittsburgh @arekfurt]

Here's the reality:
We need to shift focus away from relying on detection + response to catch and stop ransomware/extortion actors and toward preventative/blocking means.

There simply is no viable alternative if we're going to make substantial progress at societal level here.

[Koen Van Impe ☕ @cudeso]

The “Allowlist Auditor” from @AirlockDigital is great to highlight the current state of allowlisting on endpoints. Includes tests for execution (exe, dll, PS1, CPL and others) in common locations, and an audit for existing allowlisting solutions. https://t.co/iU3BhPeF90

[Daniel Schell @danonit]

Fantastic to see public recognition of @AirlockDigital as the #1 popular listing in the @CrowdStrike marketplace https://t.co/WSdVbfg35R

[Daniel Schell @danonit]

Feels too soon to be getting back on the plane after BH/DC, but looking forward to @CrowdStrike fal.con23 next week. Swing past our booth and say Hi :)

[David Cottingham @c0tts]

@jmelville It seems so! That does make life a little easier. Still unclear as to why this occurred. Intentional? unintentional? rolled back due to impact?

[David Cottingham @c0tts]

Something is happening at Digicert. It looks like on many Windows systems the VeriSign Class 3 Public Primary Certification Authority - G5 root certificate (serial: 18dad19e267de8bb4a2158cdcc6b3b4a) has been revoked as of around 9 hours ago.

[David Cottingham @c0tts]

Update: This change has been rolled back by Microsoft, with the certificate appearing as valid on systems. This can also be seen here https://t.co/ITyvhhZsvH (SHA1 4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5) showing with the status of 'Not Before'.

[David Cottingham @c0tts]

Blog writeup of what we know https://t.co/thXiNmzwTt

[David Cottingham @c0tts]

@back2all You unfortunately can't, Microsoft has set the remove flag. It's effectively perma banned. Even if you trust this yourself, the system will still block it.