Taking Pinehurst Financial's fleet to default-deny along the allowlist rail: inventory, policy design, audit mode, publisher rules, path and hash rules, scripts and installers, enforcement and maintenance; at the gate, the loan origination app is allowed by a FilePublisher rule and a vetted helper by a hash rule, while an executable in a user-writable temp folder, certutil used as a download tool and an unsigned script are stopped; and enforcement rolls out ring by ring, from a pilot ring clean for twelve days to tellers, with loan officers and servers still in audit.

CY-MID-109Mid Level · Application Control

Application Control & Allowlisting — The Allowlist Rail

A hands-on mid-level course that controls what is allowed to run on a fleet you own. Work the allowlist rail across eight stations - Inventory, Policy Design, Audit Mode, Publisher Rules, Path & Hash Rules, Scripts & Installers, Enforce, and Maintain - building default-deny WDAC/AppLocker, Santa, and fapolicyd policies with real PowerShell, event-log, and console commands, from audit-mode discovery through ringed enforcement and ongoing maintenance. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Build a real software inventory from execution telemetry across the fleet.
Design a default-deny policy scoped by device role with a base and supplemental structure.
Deploy and read audit mode to build the allowlist from real usage before enforcing.
Enforce in rings with an exception workflow, rollback, and ongoing maintenance.

Price:৳8,000