Information Security Management Handbook, Volume 5, 6th Edition

3

Chapter 1

Whitelisting for Endpoint

Defense

Rob Shein

“Whitelisting” refers to an approach for control whereby a list of “known good” activities is main-

tained. Any actions that correspond to that list are permitted, while all others are blocked or

disallowed. A classic example of this is proper firewall configuration, whereby only predefined

“acceptable” traffic is allowed to pass, and all other traffic is dropped by a default rule. ere is lit-

tle debate that, given the numerous and ever-expanding ways in which attackers learn to overcome

defensive measures, a whitelisting approach is far superior to blacklisting. e challenge, however,

is in producing ...