Security experts have called allowlisting a must-have, foundational security strategy that has the ability to stop nefarious attacks such as ransomware.

In fact, an article on CSO suggests that real-time allowlisting based on recommendations, reputation scores, and other data can theoretically “offer the promise of nearly-perfect endpoint security with very low management overhead.”

Help Net Security recently shared a similar perspective from a senior security and privacy Gartner analyst, Neil MacDonald, on how allowlisting can be used to block malicious attacks. “To lessen the risk of future attacks against vulnerabilities of all types, we have long advocated the use of application control and allowlisting on servers,” says MacDonald. “ If you haven’t done so already, now is the time to apply a default deny mindset to server workload protection – whether those workloads are physical, virtual, public cloud or container-based. This should become a standard practice and a priority for all security and risk management leaders in 2018.”

Phil Hagen, a digital forensic and incident response (DFIR) strategist at security solutions company Red Canary, agrees with MacDonald. In a recent blog, Hagen notes that “application control solutions like that offered by our partner Carbon Black are absolutely the single most meaningful step toward prevention that an organization can take. This methodology ensures that only a list of approved binaries can run on the systems within an enterprise. Whether the phishing payload is garden-variety ransomware or highly-targeted custom malware, the price of becoming a victim generally reaches far beyond that of deploying and maintaining an allowlisting solution.”

400,000 machines were infected by the WannaCry ransomware outbreak within the first week.

In today’s high-risk cyber world, it’s critical to have a complete endpoint security solution that includes allowlisting so that sensitive data is continually protected. Based on strict policies of allowable activities, allowlisting and application control allows for critical system lockdowns in real time that automatically prevent all untrusted files, applications, and processes from executing. With these sophisticated capabilities, companies can:

Stop Attacks - By allowing only approved software to run
Automate Software - Approvals and updates via IT and cloud-driven policies
Prevent Unwanted Change - To system configuration at the kernel and user mode levels
Power Device Control - File integrity monitoring and control (FIM/FIC) capabilities
Meet IT Risk - Audit controls across major regulatory mandates