-: Restricting Applications.
We've discussed how we can create
a secure baseline image to use
when we're installing a new computer.
But how do we stop Gary down in accounting
from downloading and installing
unauthorized software on our network?
To do this, we have to restrict
which applications can be run on a given workstation.
To illustrate how this works, let's consider an example.
You and I decide we want to go
to a trendy nightclub this Friday night.
We show up at the door, and we're greeted by the bouncer.
The bouncer looks at us, he asks if we're on the list,
I give him my name, he looks at the list
and realizes I'm not on the list.
This means he's not going to let me get into the club.
You're maybe cooler than I am,
and your name might have been on the list
and so you're able to get into the club.
If you and I were each an application
on the computer, this nightclub example
shows that you would be able to get in
based on whitelisting, while I would be denied.
With application whitelisting, only applications
that are on the approved list
are allowed to be run by the operating system.
All the other applications are blocked from running.
If you remember your access control list
back from Network+, this acts
like an Explicit Allow statement.
For my next example, my friend and I
are going to head to the airport.
We arrive and we walk up to the ticket counter,
we try to check in with the agent at the counter,
we hand her our passports, and she looks at our names.
After consulting her computer,
she sees that my friend's name is on the No Fly List.
Since his name's on the list,
he's denied the ability to check in,
and he's not able to take the flight.
My name, on the other hand, is not on the list,
and therefore, I'm able to go and board the airplane.
This is an example of how blacklisting works.
With application blacklisting, any application
that's placed on a list will be prevented
from running, while all of the other applications
will be permitted to run.
If you're an application whose name
shows up on the blacklist, you are going to be denied.
But all of the others will be allowed to proceed.
Why, you might be wondering, do we have
two different types of lists?
Well, using application whitelisting
is much more secure, because everything
is denied by default, and only the applications
listed can actually run.
Unfortunately, though, this is much more difficult
to set up and manage.
Every time an application is updated,
you have to adjust your whitelist.
After all, Microsoft Word 2016 version one
is not the exact same code as version two, or version three.
For this reason, many companies have chosen
to use blacklist approach instead.
But, there's problems with this approach too.
Since everything is allowed
except what's explicitly denied,
every new variation of malware or a new program
would be allowed until you create
a blacklist rule for it.
Another challenge with whitelisting and blacklisting
is managing that list across all
of the workstations in your network.
Thankfully, though, if you're using
a Microsoft Active Directory domain controller,
you can centrally manage your lists
and deploy them through your group policies.