Editing Whitelist (section)

===Application whitelists===
One approach in combating viruses and malware is to whitelist software which is considered safe to run, blocking all others.<ref>John Harrison, ''Enhancing Network Security By Preventing User-Initiated Malware Execution'', Proceedings of the International Conference on Information Technology: Coding and Computing (ITCC'05) (Wireless Ad Hoc/Sensor Networks and Network Security Track), Volume II - Volume 02; pages 597-602; IEEE Computer Society Washington, DC, USA 2005.</ref><ref>{{cite web |title=SANS Institute: Reading Room - Analyst Papers |url=http://www.sans.org/reading_room/analysts_program/McAfee_09_App_Whitelisting.pdf |archive-url=https://web.archive.org/web/20120302194448/http://www.sans.org/reading_room/analysts_program/McAfee_09_App_Whitelisting.pdf |archive-date=2012-03-02 |access-date=27 August 2018 |website=www.sans.org}}</ref><ref>{{cite web|url=http://www.darkreading.com/document.asp?doc_id=160433|title=Dark Reading - Security - Protect The Business - Enable Access|work=Dark Reading|access-date=2008-10-02|archive-date=2019-12-12|archive-url=https://web.archive.org/web/20191212161105/http://www.darkreading.com/document.asp?doc_id=160433|url-status=dead}}</ref><ref>{{cite web|url=http://www.eweek.com/c/a/Security/Application-Whitelisting-Gains-Traction/|title=Application Whitelisting Gains Traction|work=eweek.com|date=25 September 2008}}</ref> This is particularly attractive in a corporate environment, where there are typically already restrictions on what software is approved.{{cn|date=July 2024}}

Leading providers of application whitelisting technology include [[Carbon Black (company)|Bit9]], [[Velox (company)|Velox]], [[McAfee]], [[Lumension Security|Lumension]], ThreatLocker, Airlock Digital and SMAC.<ref>{{Cite web|url = http://security-architect.blogspot.com/2014/02/lessons-learned-from-target-attack.html|title = Lessons Learned from Target Breach|date = February 8, 2014|access-date = July 18, 2014|website = Security-Architect Blog|publisher = Dan Blum|last = Blum|first = Dan}}</ref><ref>{{Cite web
  | url = http://news.cnet.com/8301-10789_3-9994679-57.html
  | title = Will you be ditching your antivirus app anytime soon?
  | last = Vamosi
  | first = Robert
  | publisher = [[CNET]]
  | date = 2008-07-21
  | access-date = 2010-03-22
  | archive-date = 2012-10-24
  | archive-url = https://web.archive.org/web/20121024134536/http://news.cnet.com/8301-10789_3-9994679-57.html
  | url-status = dead
  }}</ref><ref>{{Cite web
  | url = https://smac.iqp.tech
  | title = SMAC - application whitelist platform
  | last = Korobov
  | first = EVGENIY
  | publisher = [[iqp]]
  | date = 2020-07-27
  | access-date =2020-07-27
}}</ref>

On Microsoft Windows, recent versions include [[AppLocker]], which allows administrators to control which executable files are denied or allowed to execute. With AppLocker, administrators are able to create rules based on file names, publishers or file location that will allow certain files to execute. Rules can apply to individuals or groups. Policies are used to group users into different enforcement levels. For example, some users can be added to a report-only policy that will allow administrators to understand the impact before moving that user to a higher enforcement level.{{cn|date=July 2024}}

Linux systems typically have [[AppArmor]] and [[SE Linux]] features available which can be used to effectively block all applications which are not explicitly whitelisted, and commercial products are also available.<ref>{{cite web |last1=Cooprider |first1=Nathan |title=Live Whitelisting! |url=https://www.threatstack.com/blog/whitelisting-is-dead-long-live-whitelisting |publisher=Threat Stack |access-date=20 December 2018|date=2016-02-03 }}</ref>

On HP-UX introduced a feature called "HP-UX Whitelisting" on 11iv3 version.<ref>{{cite web |title=HP-UX Whitelisting |url=https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumber=WhiteListInf |publisher=HP |access-date=20 December 2018}}</ref>