Security Application Filtering

Sophos Application Filtering in firewall with Whitelisting Applications is a security feature that allows administrators to specify which applications are allowed to run on endpoints, and to block all others. This is achieved by creating a list of approved applications (the whitelist) and denying execution of all other applications.

Whitelisting applications can help to achieve a stronger security posture by reducing the attack surface. By limiting the number of applications that are allowed to run on endpoints, it becomes more difficult for attackers to exploit vulnerabilities in unapproved software.

Referencing CIS Controls, this approach aligns with the principle of least privilege, which states that users should only have the minimum permissions necessary to perform their job functions. By restricting the execution of unapproved applications, organizations can reduce the risk of successful cyberattacks and ensure that only authorized software is running on their systems.

In reference to the CIS Controls, whitelisting applications can support the following controls:

1. Inventory and Control of Hardware Assets (Control 2) – By maintaining a list of approved applications and blocking all others, organizations can maintain better control over their hardware assets and the software running on them.
2. Inventory and Control of Software Assets (Control 3) – Whitelisting applications can help organizations to maintain a comprehensive inventory of software assets and ensure that only approved software is running on their systems.
3. Continuous Vulnerability Management (Control 5) – By limiting the number of applications that can run on endpoints, organizations can reduce the number of vulnerabilities that must be monitored and managed, making it easier to maintain a secure posture.
4. Controlled Use of Administrative Privileges (Control 6) – By limiting the number of applications that can run on endpoints, organizations can ensure that users do not have access to unapproved software that could be used to elevate privileges.
5. Maintenance, Monitoring, and Analysis of Audit Logs (Control 10) – Whitelisting applications can help organizations to monitor and analyze audit logs by reducing the number of applications that generate log events and making it easier to identify suspicious activity.

In reference to the ISO 27001 standard, whitelisting applications can support the following controls:

1. Access control (A.9.2.1) – By limiting the number of applications that can run on endpoints, organizations can control access to their information systems and ensure that only authorized software is running.
2. Configuration management (A.12.4.1) – Whitelisting applications can help organizations to manage and maintain the configuration of their information systems, ensuring that only approved software is running.
3. Media handling (A.11.2.1) – By restricting the execution of unapproved software, organizations can reduce the risk of malware being introduced to their systems via removable media.

In reference to the NIST framework, whitelisting applications can support the following controls:

1. Least privilege (AC-6) – By limiting the number of applications that can run on endpoints, organizations can ensure that users have the minimum permissions necessary to perform their job functions, reducing the risk of successful cyberattacks.
2. Malware defenses (DE-9) – By limiting the number of applications that can run on endpoints, organizations can reduce the risk of malware being executed and spreading within their systems.

In reference to the MITRE Attack framework, whitelisting applications can support the following tactics, techniques, and procedures (TTPs):

1. Initial Access (T1193) – By blocking unapproved applications from running on endpoints, organizations can reduce the number of potential entry points for attackers and make it more difficult to gain initial access.
2. Execution (T1204) – Whitelisting applications can help organizations to control the execution of software on their endpoints, ensuring that only approved applications are run and reducing the risk of exploitation and compromise.
3. Defense Evasion (T1490) – By blocking unapproved applications from running on endpoints, organizations can reduce the risk of attackers using evasion techniques to bypass security controls.
4. Persistence (T1053) – Whitelisting applications can help organizations to prevent attackers from establishing persistence by only allowing approved software to run on endpoints.