So finally, what I want to talk about is application control policies or App Locker.
Which is a feature that was introduced in Windows seven and server 2008 or two under computer configuration,
Windows Settings, Security Settings, Application Control Policies.
This is a successor to the software restriction policies that were available since the early days of
Windows.
Windows XP and even Vista.
And it provides application whitelisting and blacklisting, which is basically the ability to allow
or deny applications from running based on different rules.
So here's a screenshot that kind of gives you an idea of how app blockers laid out in the editor.
You can create four different types of rules.
And those rule types are executable rules, which are, as the name implies, based on a particular
executable or path that could reference the publisher of the executable.
The path or the file hash and file hash is just kind of a unique signature so that you can say this
particular version of PowerPoint is allowed or denied.
Installer rules apply to MSI files so you can control what kind of MSI files are executed based on publisher
path or file hash.
Script rules apply to pretty much any type of script file you can run PowerShell Batch Command, VBS,
VB script or JavaScript.
And again, based on publisher path or file hash.
And then for Windows eight X modern apps, you can apply app locker rules to those as well to control
which modern apps can either be installed or run.
And that's, you know, something like saying that the Bing Travel app or MSN Travel app, as I think
it's called now, is not allowed to run on these particular machines that received this policy.
So how does App Locker work?
So rules can either allow or deny execution.
They can be targeted at specific users or groups, and they can have exceptions.
So you can say all software from Adobe published by Adobe is allowed to run except for some particular,
you know, Photoshop version that you don't want to have being used in your environment.
You can also enforce rules actively.
So you can have windows basically shut down execution of that application or allow it, or you can just
audit activities.
So that App Locker will throw off logs that says, you know, essentially this app would have been would
have been restricted or met the rule met a particular rule.
And therefore what have been affected by App Locker policy.
So the default rules, when you first create an App Locker policy, allow kind of blanket executions.
So you can then add blacklisting rules to deny particular executions.
So blacklisting is simply as the name implies.
Putting applications on a list to say these applications cannot run.
And of course, it's easier to create a blacklist rule.
But it's also less secure because you don't necessarily know what you don't want to run.
And that list is probably always changing.
Now, the more secure approach is to change the default rule, to deny execution of everything as a
default state, and then add white list rules to selectively allow the execution of those approved applications
and processes on your systems.
Now, this is definitely more secure, but it's also a lot harder to implement because you really do
have to know every single process that is legitimate and that has a legitimate need to run on your given
systems in order to create a white list rule.
So let's let's do a quick demo of App Locker and then we'll wrap up this module.