Application allow listing (formerly called whitelisting) permits only approved software to run on a system and blocks everything else by default. It flips the traditional antivirus model. Antivirus uses a deny list: it tries to recognize known-bad programs and blocks them, which means brand-new malware, custom tools and many fileless techniques can slip through. An allow list instead asks 'is this program known and approved?' and refuses anything that is not, whether or not anyone has seen it before. That makes it one of the most effective controls against ransomware and unauthorized software. Government and industry security guidance consistently lists it among the highest-value defensive measures, precisely because it does not depend on recognizing the attacker's tools.
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 7 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.