ACSC publishes application whitelisting guide
The Australian Cyber Security Centre has issued an updated application whitelisting guide containing guidance on how to implement the threat mitigation strategy.
Application whitelisting, one of the Australian Signals Directorate’s Essential Eight cyber threat mitigation strategies, is primarily designed to protect against malicious code execution on protected systems.
According to the guide, implementing application whitelisting involves first developing applications that are safe and authorised to execute.
Second, application whitelisting rules should be developed to ensure only those applications can execute; and third, these rules should be maintained using a change management program.
Methods of determining how to enforce application whitelisting — if implemented correctly — include cryptographic hash rules, publisher certificate rules that combine both publisher and product names, and path rules if accompanied by correctly configured file system permissions preventing the unauthorised modification of folder and file contents and permissions.
The use of file names or other easily changed application attributes are inadequate methods of enforcing application whitelisting, the guide adds.
Regular tests should also be undertaken to check for misconfigurations or other methods of bypassing whitelisting rules and protocols.
Application whitelisting can also help identify attempts to execute malicious code by being configured to generate event logs for failed execution attempts. These logs should ideally include information such as the name of the blocked file, a date/time stamp, and the username of the user attempting to execute the file.
The report notes that application whitelisting does not replace the need for — and should be complemented by — antivirus and other security solutions.
Methods such as using web or email content filters to prevent the downloading of applications from the internet or using a portal for authorised applications are also not considered to be application whitelisting.
Please follow us and share on Twitter and Facebook. You can also subscribe for FREE to our weekly newsletter and quarterly magazine.
Adobe Acrobat Sign completes IRAP assessment
Adobe says its Acrobat Sign is a cloud-based solution that enables end-to-end digital experiences...
Australia under attack as higher cyber threat activity observed: report
Armis warns that AI is supercharging the cyberwarfare threat amid heightened geopolitical tensions.
Dynatrace secures IRAP certification for Azure-based platform
Dynatrace has received IRAP certification for its Dynatrace SaaS on Microsoft Azure...
