What is Application Whitelisting?
Application Whitelisting allows only trusted software to run on your network, which protects your network from malware threats.
Arellia's Application Control Solution allows you to manage applications flexibly in a large, distributed client environment by putting:
- known trusted applications in a whitelist
- potentially trusted applications in an orangelist (also known as a graylist)
- everything else in a blacklist
Multiple Whitelists
We recommend creating separate whitelists for all the separate departments within your organization. Why? Because not all departments need the same applications on their whitelist, and multiple whitelists are easier to manage than one master whitelist that includes every trusted application on your network.
Building an Initial Whitelist
A common approach to building an initial whitelist is to put all of the trusted applications in a whitelist, move everything else automatically to a blacklist, and then make changes by request. However, this approach is problematic because it results in denials of service and angry users.
The standard operating system image(s) can be leveraged to build an initial whitelist. Add to that all packages in the IT delivered software repository, which can also be added to a whitelist. The Application Control Solution allows you to add applications to your whitelist using the following attributes:
- Reference systems
- Managed software
- File ownership
- Digital signature
- Vendor
- Locations
Creating a whitelist that targets applications by filehash is not very manageable because every time an application is updated the file hash changes, and you will then have to re-add it to the whitelist policy.
We recommend targeting applications on your whitelist according to their digital signature. This results in a dynamic whitelist, because when these applications are updated the digital signature does not change and the application will remain on the whitelist.
...