Allowed vs. Blocked Listing
Controlling access to systems often involves listing items to explicitly allow or block specific files, applications, or connections.
7 slides · 2 min read · Domain 7
One of the most effective controls for minimizing malware compromises is the management or filtering of activities based on lists of allowed and blocked activities, addresses, URLs, or other identifiers.
For decades, the terms whitelisting and blacklisting have been in widespread use throughout the IT and cybersecurity professions. Recently, the terms "allowed" and "blocked" have been embraced. However, both previously published and some current works still use the old terminology.
Allowed listing permits only previously approved items to be executed and blocks execution of all others.
This control is recognized in both the National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO) frameworks, with NIST SP 800-167—Guide to Application Whitelisting providing guidance for implementation.
Software blocked and allowed lists are important tools that can provide significant defensive capabilities.
These systems detect and prevent any attempt to load and execute program files and alert designated IT security personnel if the attempt involves code not on a preapproved list. Products for software allowed lists are also starting to incorporate antimalware processes as part of their offerings. Similarly, anti-malware products have l begun to incorporate elements for software allowed lists in their range of features as well.
Unauthorized software programs can be limited to specific versions or from a specific source. The concept of prohibiting the execution of unauthorized software may also be applied to user actions, system ports and protocols, IP addresses and ranges, websites, and Media Access Control (MAC) addresses.
Organizations may verify the integrity of authorized software programs using digital signatures, cryptographic checksums, or hash functions.
Verification of authorized software can occur either prior to execution or at system startup.
This technique is effective in environments where the number of permitted applications is small. By its nature, it effectively blocks unknown threats. However, as the diversity of the organization's systems and missions increases, allowed listing may prove too restrictive for the organization's business needs.
On the other hand, blocked listing explicitly prohibits applications on the list. Applications not on the list are approved subject to the other system controls. This approach can be particularly effective when dealing with specific, known threats. Often, nuisance applications are subject to being on the blocked listing due to their impacts on organizational resources.