Application whitelisting, also called application allowlisting, permits only explicitly approved software to run and blocks everything else by default. It inverts the model traditional antivirus uses. Instead of chasing known-bad files and letting the rest execute, allowlisting assumes nothing is trusted until it appears on the approved list, which shrinks the attack surface dramatically.
CISA repeatedly ranks it among the highest-impact defenses against malware and ransomware, since unapproved payloads simply never launch. The hard part is operational, not conceptual. In environments where software updates constantly, keeping the list current takes real maintenance, and a rushed rollout that blocks legitimate business tools quickly gets whitelisting labeled an obstacle. Most successful deployments start in audit or monitor mode, learn what actually runs, and only then switch to enforcement.
How is application whitelisting tested on the CISSP?
Application whitelisting appears in Domain 7: Security Operations as an endpoint protection control. Candidates should understand how it reduces attack surface, the effort required to maintain approved software lists, and where it fits within a layered endpoint defense rather than as a standalone fix. Application control also overlaps with least privilege and change management, so questions may frame it as one layer among several.