Security & Privacy
Application whitelisting
ActivePublished
Key
innovation
A 'default-deny' model with an explicit list of trusted applications, effective even against zero-day threats.
Category
Security & Privacy
Abstraction level
Pattern
Operation level
DeploymentSystem
How it works
An administrator creates and maintains a list of allowed applications (with identifiers such as hashes, signatures, publishers or paths). The operating system or a security agent checks, on every execution attempt, whether the program is on the list; if not, it blocks execution and usually logs the event.
Problem solved
Blacklisting blocks only known threats and is helpless against new malware variants; in stable systems it is safer to allow only known, trusted applications.