In this lesson,
we'll discuss Restricting Applications.
Now let me take a moment here and ask you a question.
How many applications do you have installed
on your computer right now?
Now, I don't mean how many are you currently running,
like your web browser or your email client,
but exactly how many exist on your computer in total?
Do you have 5, 50, 500, or maybe even more?
Each application that's installing your device
will take up valuable disk space, but more importantly,
it's going to introduce additional code,
and therefore, additional vulnerabilities to your system.
To combat this, system administrators
will attempt to practice a concept
known as least functionality.
Least functionality is the process
of configuring a workstation or a server
to provide only essential applications and services
that are going to be required by that user.
To create an environment of least functionality,
your administrators need to restrict unneeded applications,
services, ports, and protocols on that system.
Now, another method of doing this
is to start uninstalling any unneeded applications.
After all, every application that's installed on a computer
has to be managed, updated, and patched for security,
and it provides yet another chance for a vulnerability
to be introduced into our systems.
Now at work, most of our computers
are going to be placed under a process
known as configuration management
to help us oversee this process.
But for our personal computers at home,
they become a mess with unnecessary programs
being installed and accumulated over time.
For example, if you go into your Program area of Windows,
you can open it up
and see all the different programs that you have installed.
You might be surprised
at just how many there are on your computer.
For this example, I have a computer here
with 132 different programs installed
that took over 400 gigabytes of disk space.
Now, looking through this list,
there's a lot of unnecessary programs
that user could have uninstalled.
As I previously mentioned,
it's really important to keep all your programs
and your software up to date.
And sometimes though, these new programs
will also be installed and leave the old version intact.
Now, for example,
I used to use a software called Adobe Premier
as a video editing software,
and every year they put out a new version
like Adobe Premier 2018, 2019, 2020, and so on.
And if I went from 2018 to 2019 or 2019 to 2020,
after the installation was complete,
we saw that both versions,
the old one and the new one
were both still installed on the computer.
So to eliminate the vulnerabilities with the older version,
we had to go back
and manually uninstall it from our systems.
Now, this may be very easy to do
if you have a small network of just a few machines,
but how do you do this
when you're managing a huge enterprise network?
For example, one network I used to manage
had over 10,000 computers spread across four countries.
It would've been nearly impossible for me
to send my system administrators out
to each of those computers
and check which ones had the programs installed
and which ones didn't.
In large networks like this,
preventing excessive installations
is going to be your best solution.
In most of our corporate networks,
it's going to be common for us
to create a secure baseline image
that we're going to use for all the workstations
that are getting installed in our company
from when they're first installed at your desk.
Now, this image will have the operating system,
the minimum applications required for that organization,
and a strict configuration policy
that's all set up for all of those machines.
Now, these policies
will have to be updated and changed over time
based on our changing business requirements.
And to do that,
we're going to be pushing out group policies and other things
across our organization using those.
So now that we've discussed
why we should be using a secure baseline
with the minimum level of functionality for our systems,
we have to figure out how are we going to stop Gary
down in accounting from downloading and installing
his own piece of software on our organization's computers.
To do this,
what we want to do is restrict which applications
can be run on a given workstation.
Now, let me give you an example of this.
Let's say you and I
wanted to go to a trendy nightclub this Friday night.
We show up at the door and were greeted by the bouncer.
Now the bouncer looks at us
and he asks, "If we're on the list?"
So I give him my name and I say, "Hey, I'm Jason Dion,"
and he looks at the list and realizes
I'm not on his list because I'm not that trendy.
Now this means he's not going to let me get into that club.
Now maybe you're cooler than I am
and your name was on the list,
and if that's the case,
they're going to let you into the club.
Now, if each of us was considered
to be an application on a computer,
this nightclub example
shows you what we're talking about
when we talk about a concept known as allowlisting.
Based on allowlisting,
I'm going to be denied because my name isn't on the list.
With application allowlisting,
only applications that are on the approved list
are going to be allowed to be run on that operating system,
and all the other applications
will get blocked from running.
This is the most secure way of doing this,
and this is what we want to do
to prevent Gary down in accounting
from installing things on our systems.
Now, if you think back to your Network+ studies,
you are probably familiar with the concept
of an access control list.
And this is essentially,
an explicit allow statement in an access control list,
but at an application level,
instead of at a network level.
Now, for my next example,
let's say that my friend and I
are going to head to the airport.
We arrive at the airport
and we walk up to the ticket counter
and we try to check in with the agent at the counter,
so we hand her our passports and she looks at our names.
After consulting her computer,
she sees that my friend is apparently a bad guy
because he's on the no-fly list.
Now because his name's on that list,
he has denied the ability to check in
and he's not able to take the flight.
Now, my name on the other hand,
is not on that list,
and therefore, I'm allowed to go and board the airplane.
This is an example of how blocklisting works,
With application blocklisting,
any application that's placed on the list
is going to be prevented from running
while all other applications will be permitted to run.
This is considered to be a less secure method
than using allowlisting, though,
because if you're an application
whose name shows up on the block list,
you're going to be denied,
but anything else, will be allowed to proceed.
Now, you may be wondering,
"Why do we have these two different types of lists?"
Well, using application allowlisting is much more secure,
as I said, because everything is denied by default
and only the things we specifically list
are going to be allowed to run.
Unfortunately, though, this is much more difficult
to set up and manage
because every time an application is updated,
you're going to have to update your allowlist too.
After all, Microsoft Word 2016
is not the exact same code as Version 2 or Version 3
or the current version of Office 365.
For this reason, many companies have chosen
to use blocklist approaches instead,
but there's a problem with this approach too
because everything is allowed
except what you explicitly deny in that list.
And so every new variation of malware
or a new program that comes out is going to be allowed
until you create a blocklist rule for it.
This becomes a big challenge
when you're dealing with allowlisting and blocklisting
because you have to manage that list
across all the workstations in your network.
Thankfully, though, if you're using
a Microsoft Windows Domain environment,
you can use
your Microsoft Active Directory Domain Controller
to be able to essentially manage all your lists
and deploy them through your group policies.
So remember, when it comes to restricting applications,
you can do this one of two ways.
You can use an allowlist or a blocklist.
If you use an allowlist,
everything is going to be blocked
except what is on the list.
If you use a blocklist, on the other hand,
everything will be allowed except what's on that list.
This is the way you have to think about these things,
and which one you're going to use
is going to depend on how secure
you want your organization to be.
For higher levels of security,
you should use an allowlist,
but at a minimum, you should be using a blocklist
to block any applications you know are malicious
or to block any applications
that you don't want running on your network.