Airlock

Airlock Digital is an allowlisting software designed to simplify the process of defining trusted files and blocking everything else, thereby proactively preventing malware, ransomware, and zero-day attacks. This software is suitable for small to large enterprises and is utilized by cybersecurity professionals, IT administrators, compliance officers, government agencies, financial institutions, system administrators, and healthcare organizations.

Key Features

Simple To Use: According to the vendor, Airlock is purpose-built to make allowlisting achievable in complex environments. It offers a user-friendly interface and intuitive workflows to simplify the allowlisting process. Designed by security professionals, Airlock aims to address operational challenges in cybersecurity.

Lightweight: The vendor claims that Airlock has minimal impact on system resources across Windows, Linux, and macOS. The Airlock Enforcement Agent is a lean agent with small policy sizes. It does not rely on large endpoint agents or bulky virus definitions.

Secure & Compliant: According to the vendor, Airlock provides effective endpoint security and helps organizations meet and maintain compliance with multiple security standards. It exceeds compliance requirements, including the Australian Signals Directorate Strategies to Mitigate Cyber Security Incidents and the NIST Guide to Application Whitelisting. Allowlisting is recommended by government agencies worldwide as a leading security strategy.

Prevention First: According to the vendor, Airlock allows organizations to define what files are trusted and blocks everything else. It proactively prevents malware, ransomware, and zero-day attacks by only allowing trusted files to run. Unlike signature-based file blocking, Airlock's allowlisting approach aims to be more granular and comprehensive.

Workflow Based Allowlisting: The vendor states that Airlock enables the creation of flexible policies with simple, repeatable workflows. It provides a searchable repository of all file metadata in the environment. The workflow-based approach aims to make allowlisting practical and manageable in dynamically changing computing environments.

Real-time Reporting, Detection, and Response: Airlock offers centralized visibility over all files within an organization, providing real-time reporting on file execution. According to the vendor, this includes information on when a file was first seen, where it came from, and how it was executed. Security operations teams can query files centrally and gain insights into file behavior.

Bulk Add Improvements: According to the vendor, Airlock's Bulk Add screen has been enhanced with a filter that automatically removes trusted files/publisher data. This improvement aims to streamline the processing of large data sets in the allowlisting workflow.

Ability to Blocklist by Certificate Thumbprint: Airlock now allows blocking of file signing certificates by their certificate thumbprint, according to the vendor. This feature aims to provide an additional mitigation when vendors' code signing certificates are stolen.

Full Path Parent Process Trust: The vendor claims that Airlock's parent process feature now supports specifying full paths to images, not just the image name itself. This enhancement aims to enhance the precision and control in defining trusted parent processes.

Ability to Disable OTP Durations: According to the vendor, Airlock allows administrators to enable or disable One Time Pad (OTP) durations in policy, providing flexibility in managing the duration of OTP sessions.