Application Control

What is Application Control?

Application control is a cybersecurity measure that regulates and manages the execution of software applications on a computer or network. It involves defining and enforcing policies that dictate whether applications can run, as well as how they are allowed to execute.

Advanced application control functionality can include enforcing granular least privilege, by controlling subfunctions of the applications and considering additional context before permitting execution.

Application control aims to enhance security by mitigating the risks associated with unauthorized or malicious software.

What are Some Application Control Techniques?

Block Listing

Block listing, also referred to as allow listing, involves broadly preventing the execution of applications based on known hashes, effectively keeping recognized malware at bay. With roughly three quarters of malware may be undetectable via signature-based tools, deny listing alone is insufficient.

Malware's rapid evolution makes it difficult for deny lists to keep pace with an ever-expanding list of files. Moreover, deny lists prove inadequate in controlling user access, as savvy users can easily circumvent them. Failures in block listing are termed ‘false negatives’, which occur when the absence of a list match wrongly assumes the software's legitimacy.

Allow Listing

Application allow listing, in contrast to deny listing, is a specific method within application control where only a pre-approved list of applications is allowed to run, effectively blocking all other applications. In other words, application allow listing is a subset of application control that focuses solely on permitting approved applications.

Keep in mind that traditional allow listing methods often rely on hashes, posing challenges. Given the multitude of applications in a typical OS install, maintaining an up to date allow list may require extensive initial configuration and ongoing updates with each system change or update.

While allow lists are effective for system hardening, the downside is that they are prone to errors, including false positives that can result in legitimate software being blocked.

Grey Listing

In complex systems, a combination of allow listing and block listing is commonly used. In such scenarios, there's often a need for a grey list—a collection of items, such as people, files, apps, or algorithms, that have not been categorized as either allow listed or block listed.

Grey lists serve as a temporary holding space, allowing for decisions to be made regarding the appropriate classification of these items. This is particularly useful for granting temporary access to newcomers, visitors, or third parties in systems requiring flexible access control.

Trusted Application Protection

Trusted Application Protection enhances standard application control by providing a higher level of confidence in the trustworthiness of applications. This technology enhances security against sophisticated threat actors layering in contextual intelligence. This also gives organizations protection against fileless malware and living off the land (LotL) attacks.

The additional context added to the process tree of application control allows for the restriction of attack chain tools, such as PowerShell and Wscript that are spawned from commonly used applications, such as browsers or document handlers (Word, PowerPoint, Excel). This added layer of security ensures that only trusted and verified applications are allowed to run, reducing the risk of malware and unauthorized software. It enhances the effectiveness of application control by focusing on the integrity and source of applications.

How Application Control Can Help Reduce Shadow IT

Shadow IT is the use of information technology systems, devices, software, applications, and services without explicit IT department approval.

Users or entire departments may use these systems or tools to meet their work objectives. Whether it makes their jobs easier, more efficient, or provides enhanced features or services outside of what’s offered through their organization, unapproved applications can still pose a significant threat.

Shadow IT is not typically implemented with malicious intent. More often, it is a result of users faced with inefficiencies or impasses that hamper productivity or completion of a deadline-sensitive task.

Application control can thwart or rein-in shadow IT attempts by enforcing policies that restrict the execution of unauthorized or unapproved applications.

How do you Implement Application Control?

When most organizations approach Application Control, they tend to follow some or all of these steps:

Assessment

Discover and document critical applications and potential risks. Determine the level of control needed for your organization's security goals.

Policy Creation

Develop application control policies based on allow listing, blocklisting, or a combination, considering trusted sources, publishers, directories, and behaviors.

Testing

Test the policies in a controlled environment to ensure they work as intended without causing disruptions.

Deployment

Deploy the policies to the target systems, utilizing security tools, Group Policy, or third-party software.

Monitoring

Continuously monitor and update the policies to adapt to changes in applications, threats, and security requirements.

Incident Response

Establish protocols to handle exceptions, false positives, and security incidents.

While these steps provide a solid starting point for implementing application control, it's important to acknowledge that the process is not without its challenges. The complexities involved in deployment, monitoring, and incident response can render this approach just a stopgap solution.

Furthermore, the threat landscape is constantly evolving, with cyberattackers now employing sophisticated tactics, including leveraging emerging AI and elusive fileless malware.

Beyond Application Control for Risk Management

Many organizations find it challenging to effectively implement allow and deny lists due to their complexities and associated management costs. While these lists offer notable benefits for endpoint security, their restrictive nature, labor-intensive upkeep, and high expenses often limit their usage to small-scale deployments, such as datacenters and kiosks.

However, integrating allow and deny listing into a privilege management strategy considerably streamlines the process. Modern PAM solutions can granularly control applications on Windows, macOS, Unix, Linux, and network devices—all without hindering end-user productivity.

Users with local admin rights possess extensive access to the operating system and all applications, including critical system folders. Maintaining allow lists for these folders proves impractical due to the frequent updates of numerous applications.

Conversely, standard user accounts lack the ability to modify these secure folders without authorization, making them more trustworthy. By combining allow listing with privilege management, a higher level of endpoint security can be achieved more efficiently and cost-effectively.