It is a dynamic structure of constantly changing code. How do we know the code is genuine, and has not been tampered with? What about updates or scripts or user applications? The desktop is not a monolithic block of code with few changes. In principle this is fairly easy: Windows other Microsoft applications third party applications.

Instead of relying on anti-malware to spot bad code, we have to identify explicitly everything we want to allow. The problem is that it is quite a large administrative burden. So it is a basic control, and it is probably mandatory if the organisation subscribes to one of the standard set of security guidelines. “Actively manage (inventory, track, and correct) all software on the network so that only authorized software is installed and can execute, and that all unauthorized and unmanaged software is found and prevented from installation or execution.” Application Control is also part of the UK National Cyber Security Centre (NCSC) platform-specific guidance for Windows 10. Inventory and Control of Software Assets. The Centre for Internet Security (CIS) defines this as one of the Basic CIS Controls: 2. Although Application Control can be used to allow or deny, it is simpler here to assume we are talking about identifying the code we allow, while all else is denied (whitelisting). One of these is to inspect executable files at runtime, to determine whether they should be allowed to run or not.

We have different layers of protection to prevent bad code from running. We know that certain types of code present a risk to data: malware or applications with known security vulnerabilities. “Application Control” is the function of allowing or denying code the ability to run on a device. It’s worth taking a look at why we need to do it. Windows Defender Application Control (WDAC) is a complicated security feature to implement on the Windows 10 desktop.

Windows defender application control