1

There are various security tools that allow an administrator to enforce only signed applications to run in a Windows operating system. is this a realistic general enforcement rule in a production server knowing that application signage is dependent on the application developer and it is not a operating system requirement?

1
  • I think it depends on what you're going to install. May 18, 2015 at 18:01

1 Answer 1

2

No, it isn't secure. Signing a application does only provide traceability and unmodifiability - the created application can be traced back to the person who signed it, and the application cannot be modified without invalidating the signature. Anyone who has the Money and possibility to go through the process of getting a code signing certificate will get one. And once they get it, they can sign anything with it, including viruses and malicious software.

Thats why Windows still warns you when trying to install signed software, but it displays the signer's Company name and subject name in the dialog box where you have to accept the installation.

To gain security, you also need to add a step called "Authorization". This means you need to scrutinize who is "approved developers".

Combining code signing with authorization, can be a effective step against malicious software instead of relying on a Whitelist. Instead of just saying for example "Microsoft office is okay to be installed", you can instead let for example end users, without administrator rights, install anything that is signed with "Microsoft", and still have security against malicious software.

Maintaining a list of approved software developers are much easier than maintaining a list of approved software, because then you can even allow users to update the software without needing elevated rights.

However, practically, its not a good solution, because most users need to run small softwares from time to time. It can be a simple thing like some software required to view a webpage related to the work the person is doing, or the person are trying to access the Company bank account for the first time and the bank needs to install some "security authenticator application".

So regardless of if your'e whitelisting software names, or if you are whitelisting developer names for signed software, such deployments are only suitable in high security Environments where its also practical to say that the computers are strictly for one purpose only. In these cases its common to install very restrictive launchers too, like "Kiosk launchers" to prevent the computers from being used to anything else than they are intended for.


To make a analogue comparisation:

Code signing is like ID-cards. Requiring every visitor to a building to show their ID card does not really add to security, since unauthorized indivuals could still enter the building using their own ID card.

To add to security, you need to also introduce a "authorization" step, where you check if the name of the ID card does match a access list or guest list of whoever is authorized to enter the building. This keeps unauthorized indivuals out from the building.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .