Whitelisting

Owned by Max Pinion (Deactivated)
Last updated: Mar 30, 2016
2 min read

Application whitelisting is a computer administration practice that defines which applications are trusted and allowed to run. This technique is often used hand-in-hand with application orangelisting and blacklisting, which targets unknown, unwanted, or untrusted software. 

Application whitelisting allows only trusted software to run on your endpoints, which protects your endpoints from unlicensed, unwanted, and malicious software. Thycotic's Application Control Solution allows you to manage an application's flexibly in a large, distributed client environment by putting:

  • known trusted applications in a whitelist
  • potentially trusted applications in an orangelist (also known as a graylist)
  • everything else in a blacklist

Multiple whitelists

We recommend creating separate whitelists for all the separate departments within your organization. Why? Because not all departments need the same applications on their whitelist, and multiple whitelists are easier to manage than one master whitelist that includes every trusted application in your environment.

Building an initial whitelist

A common approach to building an initial whitelist is to put all of the trusted applications in a whitelist and move everything else automatically to a blacklist, but only our most experienced customers should try this approach because it results in denials of service and angry users. 

The standard operating system image(s) can be leveraged to build an initial whitelist. Add to that all packages in the IT delivered software repository, which can also be added to a whitelist. The Application Control Solution allows you to add applications to your whitelist using the following attributes:

Creating a whitelist that targets applications by filehash is not very manageable because every time an application is updated the file hash changes, and you will then have to re-add it to the whitelist policy.

We recommend targeting applications on your whitelist according to their digital signature. This results in a dynamic whitelist, because when these applications are updated the digital signature does not change as often and the application will remain on the whitelist.