Allow verified publishers - Idemeum Docs

What are verified publishers?

When application allowlisting is initially deployed by IT teams, there is a concern that operational load will increase. With the default deny approach all applications are blocked, unless there is an explicit rule allowing an application. As a result, some applications might be missed, users will be frustrated, and the volume of support tickets will increase. In order to mitigate this challenge, idemeum offers a middle ground approach that provides a great balance between security and usability. With idemeum you can create a rule to allow all verified publishers on macOS and Windows. What that means is that any application that is legitimately signed by a verified developer (registered Windows or macOS developer) is allowed along with its dependencies.

• When the application is launched, the idemeum agent will extract the signing certificate chain from the application in order to verify trust.
• On macOS we leverage codesign command to extract the certificate and then use security verify-cert to determine if the application is trusted by the local trust store.
• On Windows we leverage Get-AuthenticodeSignature command that returns the status of the application signature and whether it is trusted by Windows trust store.
• What is more, idemeum will automatically allow all dependencies that these verified applications need (allowing all child process executions).

Configure all verified publishers rule

• Navigate to your idemeum admin portal.
• Access Activity -> Rules -> Add rule -> Catalog rule.
• You can now choose the rule for Windows or macOS. Select the rule that allows All verified publishers.
• Save the configuration.

If you want to create additional Deny rules, for instance, you want to allow all verified publishers but still block the cmd.exe, you can then create a separate deny rule for cmd.exe.