3

For a while now I've been kicking around the idea of implementing application whitelisting on a few sets of machines (owned by 2-3 different consulting clients) I administer that seem suitable for it. These PCs handle sensitive data (PCI-covered card info, for instance), but an employee using one of them to work with that information almost never needs to go beyond using only one or two selected desktop line-of-business programs to do so. Thus, an application whitelisting mechanism (as part of defense-in-depth) would seem like a natural possibility to consider. Implementing one would be to serve the twin purposes of (a) putting in place a technical block on the ability of users to--contrary to policy-- install or use programs like browsers or IM apps that can have very serious implications on exposure to malware-infection vectors, as well as (b) for actually (hopefully) making it much less likely that any malicious code that did make it on to one of these PCs could run successfully or install persisting malware elements on the machine.

The rub is this: these machines are all running either Windows 7 Professional edition or Windows 10 Professional edition. Meaning no Applocker, and no Device Guard (on Windows 10) as baked-in options. I've learned one can use this older technique to filter executables allowed to run by filename, by that doesn't strike me as being much of a stand-in for verifying a program is allowed by looking at signed code or a file hashes. Now, of course, there are plenty of third-party application whitelisting solutions out there...and most or all I've found so far are quite expensive, often requiring purchase of an entire security suite. Which would require me to go into internal budgeting processes with some of these customers, persuade skeptical managers, and otherwise take on a load of pain.

So, I suppose I'm asking: Are there any obvious approaches, options, etc. here that I'm missing? Any popular free / open source options I haven't quite heard about? Any known tricks for fiddling with Windows settings (like the filtering-by-name approach above), writing scripts, or anything similar I could do with Windows that would let me jerry-rig together something that's likely good-enough? Thoughts?

5

I think Software Restriction Policies are what you're looking for. It is basically the predecessor to Applocker, and it is still supported for application whitelisting or blacklisting. It isn't as powerful or comprehensive as Applocker, but on Professional versions without Applocker, it can get the job done.

See Spiceworks Guide on Deployment and Microsoft Technet Description for more details.

  • A belated thanks. I had actually read about about Software Restriction Policies in an NSA guide a while back, but thought the term was being used to refer to the general concept of software whitelisting! (Wow, missed the point on that onw.) Anyway, reading up on it more, even though the option isn't as robust as Device Guard or Applocker it should meet my current need. Thanks! – mostlyinformed Oct 1 '16 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.