For a while now I've been kicking around the idea of implementing application whitelisting on a few sets of machines (owned by 2-3 different consulting clients) I administer that seem suitable for it. These PCs handle sensitive data (PCI-covered card info, for instance), but an employee using one of them to work with that information almost never needs to go beyond using only one or two selected desktop line-of-business programs to do so. Thus, an application whitelisting mechanism (as part of defense-in-depth) would seem like a natural possibility to consider. Implementing one would be to serve the twin purposes of (a) putting in place a technical block on the ability of users to--contrary to policy-- install or use programs like browsers or IM apps that can have very serious implications on exposure to malware-infection vectors, as well as (b) for actually (hopefully) making it much less likely that any malicious code that did make it on to one of these PCs could run successfully or install persisting malware elements on the machine.
The rub is this: these machines are all running either Windows 7 Professional edition or Windows 10 Professional edition. Meaning no Applocker, and no Device Guard (on Windows 10) as baked-in options. I've learned one can use this older technique to filter executables allowed to run by filename, by that doesn't strike me as being much of a stand-in for verifying a program is allowed by looking at signed code or a file hashes. Now, of course, there are plenty of third-party application whitelisting solutions out there...and most or all I've found so far are quite expensive, often requiring purchase of an entire security suite. Which would require me to go into internal budgeting processes with some of these customers, persuade skeptical managers, and otherwise take on a load of pain.
So, I suppose I'm asking: Are there any obvious approaches, options, etc. here that I'm missing? Any popular free / open source options I haven't quite heard about? Any known tricks for fiddling with Windows settings (like the filtering-by-name approach above), writing scripts, or anything similar I could do with Windows that would let me jerry-rig together something that's likely good-enough? Thoughts?
