TechKnowSurge

VideoSecurityFree

Application Control

Application control restricts which software can run on a system, offering a more targeted layer of security than anti-malware alone by addressing risks like shadow IT and unauthorized installations.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Application control is a security mechanism that governs which software is permitted to execute on a system. While anti-malware is essential for detecting and blocking known threats, it does not address every risk — particularly shadow IT, where users install applications, devices, or services without authorization from IT teams. Even software that is not flagged as malicious can introduce vulnerabilities, and the more applications present on a system, the larger the potential attack surface becomes. Application control fills this gap by enforcing explicit rules about what can and cannot run. There are two foundational approaches to building an application control policy. A deny list specifies which applications are blocked, allowing everything else to run by default. This is a less restrictive model, well-suited for environments where only a small number of known problematic applications need to be excluded without placing heavy constraints on users. An allow list works in the opposite direction, defining the complete set of approved applications and blocking anything not on that list. This approach is considerably more restrictive but offers a much stronger security posture, since unauthorized or unknown software is prevented from executing regardless of whether it has been identified as a threat. The right choice between these two models depends on the organization's risk tolerance and the level of control required over the environment.

What you'll learn

Explain the purpose of application control as a security mechanism to mitigate risks from shadow IT and unauthorized software
Distinguish between allow lists and deny lists in application control, including the relative restrictiveness and use cases of each approach

What's covered

Application Control

Purpose & Need
- Limits Shadow IT
- Anti-malware Gaps
- Reduces Vulnerabilities
Deny List
- Blocked Apps Listed
- Everything Else Allowed
- Less Restrictive
Allow List
- Approved Apps Listed
- Everything Else Blocked
- More Secure

Key terms

Application Control: A security mechanism that restricts which applications are permitted to execute on a system, typically using allowlists or blocklists. Application control prevents unauthorized or malicious software from running even if it reaches the endpoint.
Shadow IT: The use of unauthorized software, systems, or services within an organization without IT department knowledge or approval. Shadow IT creates security blind spots because unmanaged assets fall outside standard patching, monitoring, and access controls.
Allow List: An application control approach that permits only explicitly approved applications to run, blocking everything else by default.
Deny List: An application control approach that blocks only explicitly named applications, permitting all others to run by default.
Malware: Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Vulnerability: A weakness in a system, application, or process that can be exploited by a threat actor.

Topics

Application Control Allow Lists Deny Lists Shadow It Endpoint Security Cybersecurity

Transcript

Application control is a way that we can start controlling which applications are allowed to run on our machines.

Why Anti-Malware Isn't Enough

Anti-malware is a necessary piece of our machines to make sure that we don't get malware on the machine, but it doesn't protect all aspects of our machine. One thing it doesn't do is guard us against shadow IT. There are users out there that will install devices, software and services without IT's knowledge, and this can be really problematic. There could be legitimate software in a lot of cases that isn't going to be flagged by anti-malware software, but gets installed by the user, which does cause problems.

Remember, the more software we have installed on our computer, the more it opens up vulnerabilities for us. So we want to be able to control that and stop things like shadow IT from happening. Application control is something that we can use to control what applications are allowed to run and what applications aren't allowed to run.

Deny Lists and Allow Lists

There are essentially two different ways that we could approach creating an application control list: a list of applications that are either allowed or denied. Despite what the names sound like, the allow list is actually a lot more strict than the deny list.

The deny list is going to be a list of applications that are not allowed. By saying that they are not allowed — so maybe we've got these three applications that aren't allowed — it actually includes a lot more than what an allow list would have. The reason is because everything else besides these is allowed. So that essentially means most everything is allowed except for these three applications right here. It's a great way to control things if there are specific applications you've found problematic but you don't want to be too controlling over the environment.

Just as the name suggests, an allow list does exactly the opposite. It says what applications are allowed to run. This is much more restrictive, and the reason is because these are allowed to run and everything else outside of this is not allowed to run. So from a security perspective, it's much more shut down. It's much more secure than a denial list would be.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →