Editorial content. Not sponsored and not written by a vendor.
The idea in one sentence
Allowlisting permits only approved software to run and blocks everything else by default.
How rules are defined
- File hash — exact file match
- Publisher certificate — trusts a signed vendor
- Path — trusts a folder location
- Parent process — trusts software launched by an approved installer
Trade-offs
Allowlisting is a strong preventive control, but it requires an approval process. Organizations with frequently changing software should plan for that workload.
Questions to ask about any allowlisting tool
- How does the tool learn which software is legitimate in our environment?
- How are vendor software updates allowed without writing a new rule each time?
- Can users request exceptions, and how quickly are they approved?