Application Blocklisting
Reducing the attack surface of applications is becoming increasingly critical for security teams, as modern software often includes rich functionality that can be exploited by malicious actors to achieve their objectives.
Airlock Digital’s blocklisting capabilities provide a powerful and flexible framework to reduce the attack surface of applications by controlling how they behave. For example, you can block Microsoft Office from calling Powershell, or stop complex software such as web browsers from spawning untrusted processes.
Blocklisting also serves as a powerful control over Shadow IT, prohibiting the use of unwanted applications (including remote access tools such as TeamViewer.)
Even more, blocklisting provides an effective control if legitimate, trusted applications are exploited due to a vulnerability - minimizing attacker "break out."
-
-
- Prevent the use of Living off the Land binaries (commonly known as LOLBins);
- Prohibit unwanted versions of applications from executing (e.g. outdated or vulnerable applications);
- Overrule any attempted allowlisting bypasses.
-
When utilized in tandem with effective allowlisting, blocklisting enforces effective application containment, safeguarding IT and OT environments alike.
Scalable, Precision Blocklisting
Blocklisting: Effective Attack Surface Reduction
Airlock Digital’s blocklisting capabilities empower organizations to proactively reduce their endpoint attack surface, by scoping the use of known LOLbins. This forces attackers to bring their own capabilities, significantly increasing cost and complexity for attackers.
Blocklisting is one of the most effective strategies to prevent modern attack chains.
Leverage predefined blocklist packages that enable the proactive prevention of capability within your environment that may provide undesired functionality (e.g. script interpreters), often used for malicious purposes or as an attempt to bypass allowlisting controls.