Instructor: In this lesson 2 2
we're going to discuss two important concepts 3 3
known as block listing and allow listing. 4 4
First, block listing. 5 5
Block listing is the process of blocking known applications, 6 6
services, traffic or other transmissions 7 7
to and from your systems. 8 8
Now, the idea with block listing 9 9
is that this is a security configuration 10 10
where access being permitted 11 11
unless the entry appears on a block list. 12 12
Let me give you an analogy. 13 13
Let's say you and I decide we want to go 14 14
to the nightclub tonight. 15 15
We show up at the front door 16 16
and the bouncer looks at his list. 17 17
He looks up and down 18 18
and he doesn't see our name on the list 19 19
which means we've never caused any trouble before. 20 20
And so he lets us in the building. 21 21
That's the idea of a block list. 22 22
Since our name wasn't on the list, 23 23
we were considered okay and we were allowed in. 24 24
But if one of our names was on the list, 25 25
he wouldn't have let us in 26 26
and he would've stopped us or blocked us from entering. 27 27
Now that's the whole idea with a block list. 28 28
You know what's bad and you're looking 29 29
for those bad things so you can block them. 30 30
Now, block lists are quite useful to us 31 31
especially an incident response 32 32
because we can block the source of malware 33 33
from able to communicate into our network. 34 34
So if I know something's bad 35 35
and I know what I'm looking for, 36 36
I can then say that this particular IP address 37 37
is part of a C2 network 38 38
and we can put all those IP addresses 39 39
that are known bad into a block list 40 40
and we can then block them from accessing our network. 41 41
Here you can see that I have a total band list 42 42
of 3,903 IP addresses in my list. 43 43
These are all the systems with known bad IP addresses 44 44
and therefore I want to show anything in my network 45 45
isn't reaching out to those bad IP addresses. 46 46
So I would block them using my firewall. 47 47
Now, that's great except for the fact 48 48
that there are millions and millions 49 49
of other IP addresses out there that aren't on my list 50 50
and some of those could potentially be bad as well. 51 51
And so if I miss something by not putting in my block list, 52 52
people can still access it 53 53
and our networks can still get infected. 54 54
So what are some limitations we have to think about 55 55
when we're using block lists? 56 56
Well, first we have to think about 57 57
the risk of false positives 58 58
that could actually block legitimate traffic. 59 59
Let's say we had a false positive that showed up 60 60
and said this IP address is bad 61 61
so we go ahead and we block it. 62 62
Well, that IP address may not have been bad 63 63
and if we put it in our block list, we now can't access it 64 64
and we're denying legitimate users to be able to access it. 65 65
This actually happened to my own company 66 66
when we first launched our website. 67 67
When we first launched our website, 68 68
we were issued an IP address from our service provider 69 69
but that IP address apparently used to be used by a spammer 70 70
and so it was on a lot of different block lists out there. 71 71
And when people tried to get to our site, 72 72
some of them were getting blocked 73 73
by their service providers saying don't go to that site, 74 74
it's spam, it's bad, it's malicious. 75 75
And so we had to go out and get a new IP address 76 76
so we could not be blocked 77 77
by these other service provider systems 78 78
even though we weren't the ones 79 79
who originally had the problem. 80 80
And so legitimate traffic can actually be blocked 81 81
because of a false positive when you're using a block list 82 82
as you could see here. 83 83
Now, the second thing you have to think about 84 84
is that you don't always know everything 85 85
that should be blocked. 86 86
Now this is a big problem 87 87
because you're dealing with block listing. 88 88
You have to know exactly what is bad 89 89
so you can add it to your block list. 90 90
And if you don't know exactly what you need to block 91 91
because the bad folks keep moving to different IP addresses 92 92
then your block list isn't going to do you any good. 93 93
And so this is one of the big issues you have to think about 94 94
when you use block listing. 95 95
Now, on the other side of the coin though 96 96
we have this thing known as allow listing. 97 97
Now, allow listing is the process 98 98
of allowing only known applications, services 99 99
traffic and other transmissions to and from your systems. 100 100
Essentially, you get a list with all the allowed things 101 101
and this is a security configuration list 102 102
and access is always going to be allowed 103 103
to anybody on the list, 104 104
but if you're not on that list, you are going to be denied. 105 105
So let's go back to our nightclub example. 106 106
You and I get to the front door, 107 107
we get up to the bouncer and we say, "Hi, my name's Jason." 108 108
He looks as list, he sees my name 109 109
and let's me in because I'm on his allow list. 110 110
You go up next and you say, "Hi, my name is Susan" 111 111
and they look and they say, "Nope, no, Susan on the list. 112 112
Go away. You're not allowed in." 113 113
That's how allow listing works. 114 114
If your name is not on the list, you're not getting in. 115 115
When we do block listing, it's the opposite. 116 116
If your name is on the list, 117 117
we are going to block you and not allow you in. 118 118
That's the concept here. 119 119
Now, when you're using allow listing, 120 120
this can be really effective as a fallback posture 121 121
especially during an instant response. 122 122
Let's say your network has come under attack, 123 123
you want to get back online as quickly as possible 124 124
and cut off all the bad communication. 125 125
What can you do? 126 126
Well, you can move to an allow list. 127 127
You might have a preset allow list that says, hey 128 128
here are the 10 websites that I truly trust. 129 129
I trust Gmail, I trust Diontraining.com 130 130
I trust Facebook, whatever it is. 131 131
Then anything that's not in that list you're going to block. 132 132
that would be a good allow list. 133 133
Now, you might not want to use that every single day 134 134
but you can use it as a fallback posture 135 135
during an instant response. 136 136
So you might have some things on there like your banking, 137 137
your email, and some basic functions like that 138 138
but you can cut off a lot of things that you don't need 139 139
and that's the idea of this as a fallback posture. 140 140
Now, let me give you a quick warning here 141 141
when you're dealing with a allow list, 142 142
especially when you're doing 'em in this fallback posture. 143 143
Allow lists are incredibly restrictive. 144 144
They can prevent users and systems from transmitting data 145 145
to new or changed recipients. 146 146
So let's say you had me 147 147
on your allow list as DionTraining.com 148 148
but I now just changed my website to www.DionTraining.com. 149 149
And if I do that 150 150
and you don't have www.DionTraining.com 151 151
listed in your allow list, 152 152
you are not going to get to my website. 153 153
You're not going to be able to get to me anymore 154 154
because of that minor change of going from 155 155
DionTraining.com to www.DionTraining.com. 156 156
So you always need to make sure 157 157
you're constantly fine tuning these allow list 158 158
to avoid interference with business operations. 159 159
Similarly, if you're using IP addresses on your allow list 160 160
this can also cause issues for you 161 161
because many servers use multiple IP addresses 162 162
and do load balancing. 163 163
So if you only have an IP address 164 164
for one of those four servers, 165 165
you're actually going to have a decline in performance 166 166
because now you can't load balance across four servers 167 167
and you're only going to be using one. 168 168
This again is another issue when you're using allow list. 169 169
Now, in a lot of the organizations 170 170
I've worked with in the past, we have kept an allow list 171 171
as a backup as I said, so we can use it 172 172
when we have an instant response. 173 173
But in general, we instead use a block list method 174 174
on a day-to-day basis. 175 175
This way, if we got attack 176 176
or we need to go to a more restrictive method 177 177
we can switch over to our allow list at any time 178 178
because we have this allow list ready to go. 179 179
But again, keep in mind that allow list 180 180
can be very hard to keep up to date 181 181
because there's always new challenges 182 182
and changes that are occurring. 183 183
For example, let's say you just started working 184 184
with a new supplier and you need to go 185 185
to some other site to pay your bill. 186 186
Well, it's not on your allow list. 187 187
You're not going to be able to get to that site 188 188
and pay your bill 189 189
and that now becomes another issue for you. 190 190
Now, this isn't to say that allow lists 191 191
are all bad or all good. 192 192
There is a really good place for them 193 193
and one of the best places I see them 194 194
is inside the world of application allowlisting. 195 195
Now, when we talk about application allowlisting 196 196
we have to first look at the concept of execution control. 197 197
Execution control is the process of determining 198 198
what additional software may be installed 199 199
on a client or server beyond its baseline. 200 200
So let's say I gave you a workstation in your office 201 201
and it has some basic programs on there. 202 202
You've got Microsoft Office, you've got Adobe Acrobat, 203 203
you've got Microsoft Edge and Google Chrome 204 204
but you don't have anything else and you're like, 205 205
"Hey, I want to install Google Earth on this machine." 206 206
So you try to download it 207 207
and install it and it won't install, why? 208 208
Well, that might be because of my execution control 209 209
and the way I've set this up. 210 210
Now with execution control, I can actually prevent you 211 211
from being able to install new software 212 212
or from able to run software that's been installed 213 213
if it's not on my allow list. 214 214
For example, in Windows 215 215
you could do this a couple of different ways. 216 216
One of the ways is to use SRP 217 217
which is software restriction policies. 218 218
Now, this is available for most versions of Windows 219 219
and it can be configured 220 220
as part of your group policy objects. 221 221
This creates an allow list file 222 222
for different system locations 223 223
where your executables and scripts 224 224
are allowed to be launched from. 225 225
For example, if you use a block list method 226 226
you can actually say that no executables 227 227
can be run from the temp directory 228 228
or you can use an allow list methodology 229 229
where it says you can only run things 230 230
out of the System directory and the Program Files directory. 231 231
This would allow you to do this 232 232
by creating this application allow list. 233 233
Now, another way you can do this is by setting up rules 234 234
configured by hash files on those programs. 235 235
So if I install Microsoft Word and I take a hash of that, 236 236
I can add that to my approved list, 237 237
and then this will allow me to run anything 238 238
that has the approved hash. 239 239
Alternatively though, if you wanted to 240 240
you could use software restriction policies 241 241
to block things based on a block list 242 242
instead of an allow list. 243 243
Personally, I prefer to allow list my applications 244 244
and that way I can control exactly what's on my baseline. 245 245
But a block list is another valid way 246 246
of doing it too in some organizations. 247 247
Now, another way you can do this is by using something 248 248
known as AppLocker inside of Windows. 249 249
AppLocker is used to improve the configuration options 250 250
and defaults of the SRP. 251 251
And basically, AppLocker policies can be applied to a user 252 252
or group accounts instead of just on a single computer. 253 253
And so it gives you a little bit more granularity. 254 254
Now, the downside of using App Locker 255 255
is you can only use it if you're using the enterprise 256 256
or ultimate editions of Windows, 257 257
and not if you're using a home version. 258 258
The next one we have is what's known 259 259
as Windows Defender Application Control or WDAC. 260 260
This allows you to create a code integrity policy 261 261
and this can be used on its own 262 262
or in conjunction with AppLocker. 263 263
Now, all of these policies can allow the computer 264 264
and the users to be affected, 265 265
and they can be based on a version aware 266 266
or digital signatures for a particular application 267 267
using their image hash or file path. 268 268
So they're really good at doing this 269 269
and they also allow you to prevent administrative accounts 270 270
from disabling execution options 271 271
and this forces them into having these controls as well. 272 272
Now, all that's great, but what if you're running Linux? 273 273
Do you have a solution for that? 274 274
Well, yes, we do. 275 275
With Linux we also have execution control 276 276
and we do this with one of two methods. 277 277
This is either the mandatory access control known as MAC 278 278
or we can use the Linux security modules known as LSF. 279 279
Now, in Linux, we have something known 280 280
as SELinux and AppArmor 281 281
and these are probably two of the most well known programs 282 282
that provide Linux security modules for us 283 283
and they're pretty heavily used inside enterprise networks 284 284
if you're running Linux servers. 285 285
Now, the last thing we need to talk about here 286 286
in terms of allow listing and block listing 287 287
is how are you going to manage all the configuration changes 288 288
that you're going to do 289 289
in terms of these allow list and block lists? 290 290
Well, the way we do that 291 291
is by doing configuration management. 292 292
Configuration management will allow us 293 293
to have a process in place of how we're going to update 294 294
all of our block lists and our allow list 295 295
for any of those changes. 296 296
And we'll do this in response to user requests, 297 297
in response to business operations, 298 298
and in response to incident responses as well. 299 299
So as you're doing all of these 300 300
there's lots of different changes that have to occur 301 301
and you're going to have to make sure that you're keeping track 302 302
of all these changes and pushing them out 303 303
to all of your machines to keep that baseline consistent. 304 304
Now, if you're going to go through a large change, 305 305
you're going to have to make sure you do a risk assessment 306 306
and a business impact analysis 307 307
to ensure you're not going to break anything. 308 308
And we're going to talk more about risk assessments, 309 309
change control, and business impact analysis 310 310
later on in this course as we move into later sections 311 311
and into other domains.