Before we dive too deep into the concept of whitelisting, readers must understand what application whitelisting is.\u00a0 In addition, understand how it differs from alternative cyber security methods.\u00a0 First, application whitelisting is a proactive approach to cyber security.\u00a0 A security solution that employs application whitelisting will only allow known trusted programs to run.\u00a0 The alternative, blacklisting, allows all unknown files to run unless they’ve already been proven to be malicious.\u00a0 The issue with the blacklist is, malware variants are morphing by the minute, making them “unknown” files.\u00a0 These unknown files will execute on any device employing a blacklist as its primary method of malware detection.\u00a0 Meanwhile, any device using a whitelisting agent will block these files from running, until proven safe.<\/p>\n
The whitelist offers increased security for all data on devices utilizing this proactive methodology.\u00a0 Meaning, malware attacks, including ransomware, are far less likely to successfully execute.\u00a0 Leading industry analysts from Gartner and Forrester have agreed, application whitelisting is the best way to mitigate today’s cyber security threats.\u00a0 Although, there are a few downfalls.<\/p>\n
Mario DeBoer, an analyst at Gartner, recently told me he does not encourage anyone to change their security solution unless they state they want something different.\u00a0 When asked why he simply said, it is too much work.\u00a0 Needless to say, this caught me off guard.\u00a0 Too much work?\u00a0 Maintaining a less than effective security infrastructure because enhancing it would be “too much work” is not only laughable but does the company a major disservice.\u00a0 To be clear, uninstalling an existing solution and deploying a new one could be time-consuming for the IT staff.\u00a0 However, finding a security solution that offers assistance with the installation and deployment process would help mitigate not only the cost associated with switching but the time invested by the company’s staff to make the change.<\/p>\n
There is also the risk of “false positives”.\u00a0 A false positive is when the whitelist blocks an unknown file or program from running when it is not malicious.\u00a0 The number of false positives a user experiences varies based on the whitelist used by their security vendor, and the type of programs and files they’re running on their devices.\u00a0 The concept of false positives has been a barrier for larger businesses and school districts to integrate a whitelist approach.\u00a0 Due to the number of files and programs running on a daily basis, the management of false positives is perceived to outweigh the benefits of increased security.<\/p>\n
Many application whitelisting programs allow the users to locally whitelist a program or file, almost immediately.\u00a0 Jon Amato, an analyst for Gartner stated the ideal turnaround time for a false positive should be less than 15 minutes.\u00a0 This is certainly attainable.\u00a0 So, the question remains, does the minor and infrequent inconvenience of false positives outweigh the benefits of increased security measures?<\/p>\n
Consider the alternative.\u00a0 The unknown file is allowed to execute and leads to the encryption of systems and files.\u00a0 This leaves the organization inoperable, or at a minimum — going back to pen and paper mode.\u00a0 The cost of downtime, remediation overtime pay, third-party investigators to assess damages, reputation damage, loss of productivity, and inability to conduct day to day operations could be detrimental.<\/p>\n
So again, the question remains, does the minor and infrequent inconvenience of false positives outweigh the benefits of increased security measures?\u00a0 You tell me.<\/p>\n","protected":false},"excerpt":{"rendered":"
Application Whitelisting – What is it? Before we dive too deep into the concept of whitelisting, readers must understand what application whitelisting is.\u00a0 In addition, understand how it differs from alternative cyber security methods.\u00a0 First, application whitelisting is a proactive approach to cyber security.\u00a0 A security solution that employs application whitelisting will only allow known […]<\/p>\n","protected":false},"author":54,"featured_media":55214,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[7,4959],"tags":[4989],"class_list":["post-59257","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-newsletter","category-whitelisting","tag-application-whitelisting"],"yoast_head":"\n