Application control (allowlisting)

Application control is the technical rule that lets a workstation or server run only the programs on an approved list, and blocks everything else by default. Antivirus looks for what is known to be bad; application control refuses whatever is not known to be good. The reversal takes one sentence to state and a lot of work to keep up. On Windows the native tools are AppLocker and WDAC (Windows Defender Application Control), which allow software by signing publisher, by path or by file hash. Australia's Essential Eight lists it first among its eight strategies, and the Australian agency already ranked it among its priority measures before that framework existed. The cyber application rarely makes it a knockout question, more often a maturity one: does the control cover servers, every workstation, and does it run in audit mode or enforcement mode? Audit mode is the classic trap. It logs what would have been blocked without blocking anything, and companies sit there for years for fear of breaking a business application. The underwriter sees none of this from outside and relies on the interview, on configuration evidence or on an auditor's report. Attackers know the blind spots. A path rule that allows the user's whole downloads folder protects nothing. And Windows' own signed binaries, PowerShell and mshta first among them, are allowed by design: a living-off-the-land attack hijacks them without ever bringing in a foreign program. Application control slows commodity ransomware a great deal. Against a patient operator who already holds admin rights, it counts for much less.