Summary of Reddit Comments on "ThreatLocker"

Overview of ThreatLocker

• Pros:
  • Effective at application control, elevation, and ringfencing.
  • Helps support legacy systems securely.
  • Provides a complete audit of user actions on endpoints.
  • Offers great support and built-in application definitions.
  • Can be combined with other security tools like Crowdstrike.
  • Can prevent unauthorized software from running.
  • Cyber Hero service available for quicker approvals and support.
• Cons:
  • Complex setup and maintenance that requires learning and tuning.
  • Can make Automations difficult.
  • Some issues with Mac processes and certain apps like Photoshop.
  • Issues with elevation control policies not functioning correctly.
  • Troubleshooting issues can be time-consuming.
  • Application requests from End users can be a challenge to manage.

User Experiences and Recommendations:

• Positive Experiences:
  • Some users have found ThreatLocker to be a game-changer in terms of security.
  • Efficient in preventing security threats and providing peace of mind.
  • Great support services like Cyber Hero Approvals.
  • Enhances security Compliance and provides a strong security tool.
• Challenges and Concerns:
  • Resource-intensive and requires significant time investment to manage properly.
  • Can be a pain to implement and maintain, especially in dynamic environments.
  • Some users have faced issues with deployment, one-off program conflicts, and management headaches.
  • Not suitable for scenarios with limited help desk personnel or high update frequencies.

Recommendations and Suggestions:

• Consideration of Business Environment:
  • Recommendation for high security-minded environments with adequate staff.
  • May not be suitable for high-volume application requests in busy work environments.
  • Optimal for environments with dedicated IT staff and the ability to manage requests promptly.
• Support and Management:
  • Recommendation for incorporating Cyberhero Support into processes.
  • Consider outsourcing security if lacking core competency or manpower to manage ThreatLocker effectively.
  • Need for options to have external parties manage ThreatLocker approvals to reduce workload.

Additional Insights:

• Language and Terminology:
  • Use of "allowlisting" and "blocklisting" suggested over potentially controversial terms.
• Technical Functionality:
  • Issue noted regarding firmware updates being denied and causing hardware failures in specific cases.
• Management and Maintenance:
  • Wildcards in path rules and functionality should be considered for ease of use.
  • Issues with the upkeep and complexity of maintenance highlighted.

Conclusion:

• ThreatLocker is deemed effective in enhancing security but requires significant investment in learning and maintenance. Consideration of business environment, staffing capabilities, and support services is crucial for successful implementation and management.