Application allowlisting

What it is

Only software you have approved is allowed to run, and everything else is blocked by default. Modern tools learn what each machine already uses, so the approved list can be built without months of manual work. Some also limit what approved programs may do, for example stopping a document editor from starting PowerShell.

How to value it

Most ransomware and hands-on-keyboard attacks need to run something new on the victim's computers: a malware file, a remote-access tool, a network scanner. Blocking unapproved software stops that whole class of attack, instead of trying to recognise each new variant, which is why the Australian Signals Directorate lists application control in its Essential Eight. The real cost is the approval process: if approving new software takes days, people will look for ways around it.

Questions to ask a vendor

1. 1How is the first approved list built, and how long does learning take before blocking starts?
2. 2How quickly can a blocked user get a legitimate program approved, and who approves it?
3. 3Can it also control scripts and libraries, and limit what approved programs may do, such as starting PowerShell or reaching the network?
4. 4How does it handle software updates without breaking the approved list?

Risk

Ransomware or attacker tools running on workstations and servers.

Control

Application allowlisting in blocking mode on servers and endpoints, with a fast approval process for new software.

Owner

Endpoint or IT operations lead.

Measure

Share of endpoints in blocking mode and median approval time for new software.

A starting point: set the owner and measure to fit your organisation.