3 ms·

The initial foothold exploits - where application whitelisting would help the most - generally are not "critical systems", they are the daily workstations of ra

The initial foothold exploits - where application whitelisting would help the most - generally are not "critical systems", they are the daily workstations of random employees. By the time the attackers reach your critical systems, they most likely can attack them with stolen credentials without running any exploits that whitelisting would prevent. To protect your company, application whitelisting needs enough usability to be easily supportable for the workstations of your accountant, office receptionist, and the VP of Marketing (those three are all good examples of valuable entry points for targeted attacks), which all may get management approval to throw out application whitelisting if it inconveniences them enough - there's no reasonable tradeoff between security and usability, you must get both as usability is mandatory and usability deficiencies will result in security features getting removed in all but the most critical circumstances.

bagacrap 5y ago
What makes app whitelisting hard to use on an employee's corporate issue laptop? They shouldn't install anything that doesn't have a business purpose, and these days there are hardly any native apps people want to install anyway.
- R0b0t1 5y ago
  Nothing, in theory. There is a lot of clerical office work, or fixed flow work (like CNC machining) that doesn't need new programs. But there is also a fair amount of IT work that is hampered enough by whitelisting that IT is the one that does not want to do the whitelisting. Some of this can be blamed on Windows IT admins finding it normal to download random binaries and run them for diagnostic information or configuration management, but that is not an easy problem to solve.
- benhurmarcel 5y ago
  In practice it's quite common to run (and sometimes install) software that isn't whitelisted officially, even if it's outside strict IT rules. Otherwise have fun editing scripts with Notepad++ because IT never cared to allow VSCode, unzipping using Windows Explorer's feature because your request for 7zip was denied since the feature exists on paper, navigating the web without content blocker, being restricted to Python 3.1 because the responsible doesn't care about updates, not being able to run your own compiled scripts, being unable to run your keyboard macros, having to manage your passwords in a txt file, having only Excel to analyze data…

bagacrap 5y ago

What makes app whitelisting hard to use on an employee's corporate issue laptop? They shouldn't install anything that doesn't have a business purpose, and these days there are hardly any native apps people want to install anyway.

R0b0t1 5y ago
Nothing, in theory. There is a lot of clerical office work, or fixed flow work (like CNC machining) that doesn't need new programs. But there is also a fair amount of IT work that is hampered enough by whitelisting that IT is the one that does not want to do the whitelisting. Some of this can be blamed on Windows IT admins finding it normal to download random binaries and run them for diagnostic information or configuration management, but that is not an easy problem to solve.
benhurmarcel 5y ago
In practice it's quite common to run (and sometimes install) software that isn't whitelisted officially, even if it's outside strict IT rules. Otherwise have fun editing scripts with Notepad++ because IT never cared to allow VSCode, unzipping using Windows Explorer's feature because your request for 7zip was denied since the feature exists on paper, navigating the web without content blocker, being restricted to Python 3.1 because the responsible doesn't care about updates, not being able to run your own compiled scripts, being unable to run your keyboard macros, having to manage your passwords in a txt file, having only Excel to analyze data…