TechKnowSurge
TechKnowSurge Catalog Videos Application Control
VideoSecurityFree

Application Control

Application control restricts which software can run on a system, offering a targeted way to reduce vulnerabilities and prevent unauthorized installations. Two core approaches—allow lists and deny lists—provide different levels of restriction depending on the security requirements of the environment.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Anti-malware software is an essential layer of endpoint defense, but it does not address every risk on a system. One significant gap is shadow IT—the installation of devices, software, or services by users without organizational knowledge or approval. Even legitimate software that evades malware detection can introduce vulnerabilities, since every additional application installed on a machine expands its attack surface. Application control fills this gap by enforcing policies that govern which software is permitted to run. There are two fundamental approaches to building an application control policy. A deny list identifies specific applications that are blocked, while everything not on the list is allowed to run freely. This model is less restrictive and works well when the goal is to eliminate a known set of problematic applications without tightly limiting the broader environment. An allow list takes the opposite approach, defining exactly which applications are permitted to execute and blocking everything else by default. While this model requires more upfront configuration, it provides a significantly higher level of security and is the preferred choice in environments where strict control over the software landscape is a priority.

What you'll learn

What's covered

Application Control

Key terms

Application Control
A security mechanism that restricts which applications are permitted to execute on a system, typically using allowlists or blocklists. Application control prevents unauthorized or malicious software from running even if it reaches the endpoint.
Allowlist
An application control approach that permits only explicitly approved applications to run, blocking everything else by default.
Denylist
An application control approach that blocks only explicitly prohibited applications, allowing everything else to run by default.
Shadow IT
The use of unauthorized software, systems, or services within an organization without IT department knowledge or approval. Shadow IT creates security blind spots because unmanaged assets fall outside standard patching, monitoring, and access controls.
Attack Surface
The total set of points in a system where an unauthorized user can attempt to enter or extract data.
Malware
Software specifically designed to disrupt, damage, or gain unauthorized access to a system.

Topics

Application Control Allowlisting Denylisting Shadow It Endpoint Security Cybersecurity

Transcript

Application control is a way that we can start controlling which applications are allowed to run on our machines.

Why Anti-Malware Isn't Enough

Anti-malware is a necessary piece of our machines to make sure that we don't get malware on the machine. But it doesn't protect all aspects of our machine. One thing it doesn't do is guard us against shadow IT. There are users out there that will install devices, software, and services without IT's knowledge. This can be really problematic.

There could be legitimate software in a lot of cases that isn't going to be flagged by anti-malware software, but gets installed by the user, which does cause problems. Remember, the more software we have installed on our computer, the more it opens up vulnerabilities for us. So we want to be able to control that and stop things like shadow IT from happening.

Allow Lists and Deny Lists

Application control is something that we can use to control what applications are allowed to run and what applications aren't allowed to run. There are essentially two different ways that we could approach creating an application control list — a list of applications that are either allowed or denied. And despite what the names sound like, the allow is actually a lot more strict than the deny.

The deny list is going to be a list of applications that are not allowed. And by saying that they are not allowed — so maybe we've got these three applications that aren't allowed — it actually includes a lot more than what an allow list would have. The reason is because everything else besides these are allowed. So that essentially means most everything is allowed except for these three applications right here. It's a great way to control things if there are specific applications you've found problematic but you don't want to be too controlling over the environment.

Just as the name suggests, an allow list does exactly the opposite. It says what applications are allowed to run. This is much more restrictive, and the reason is because these are allowed to run and everything else outside of this is not allowed to run. So from a security perspective, it's much more shut down. It's much more secure than a denial list would be.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →