Allowlisting Auditor

The Allowlist Auditor is a free utility developed by Airlock Digital designed to comprehensively audit application whitelists for weaknesses, regardless of vendor. It performs automated file load tests and identifies policy weaknesses that can be exploited by attackers.

The Allowlist Auditor includes a mode to audit both Microsoft AppLocker™ deployments and Windows Defender DeviceGuard™  / Application Control and displays complex policies and associated problems clearly.

The utility is designed to be run as a standard (non-privileged) user.

The auditor is a free utility developed designed to comprehensively test application allowlists for weaknesses and misconfigurations, regardless of vendor. It achieves this by performing automated file load tests and identifies areas on a system where untrusted code can successfully execute.

As security practitioners at heart, Airlock Digital understands the importance of ensuring auditability of not only the software that it produces, but also that of the wider endpoint security industry. It’s extremely important that practitioners implementing defensive security controls have:

• An easy way to validate that their endpoint security is delivering the intended security outcome

• A way to identify policy gaps which could be used by attackers to bypass
  security controls; and

• Independent methods to demonstrate to auditors that their implementation is
  effective.