Which term describes allowing only approved software to run on a system to prevent malware execution?

Which term describes allowing only approved software to run on a system to prevent malware execution?

• A. Code signing
• B. Application whitelisting
• C. Security baselines
• D. Blacklist enforcement

Answer: (B)

This is about controlling what can run on a system by allowing only approved software to execute, which is known as application whitelisting. It works on a default-deny principle: if a program isn’t on the trusted list, it won’t run. This approach directly stops malware from executing because unknown or untrusted executables are blocked unless they’re added to the whitelist or signed and re-approved. In practice, the whitelist can be built from things like cryptographic hashes of approved programs, trusted publishers, or specific file paths. Enforcement can be applied at the operating system level through tools like AppLocker or similar application-control mechanisms. This differs from code signing alone, which verifies that software came from a legitimate publisher but doesn’t by itself prevent unapproved software from running without enforcement. It also differs from blacklist enforcement, which blocks known bad software but doesn’t prevent the execution of unknown threats. Security baselines describe standard configurations, not the specific control of allowing only approved software.

This is about controlling what can run on a system by allowing only approved software to execute, which is known as application whitelisting. It works on a default-deny principle: if a program isn’t on the trusted list, it won’t run. This approach directly stops malware from executing because unknown or untrusted executables are blocked unless they’re added to the whitelist or signed and re-approved.

In practice, the whitelist can be built from things like cryptographic hashes of approved programs, trusted publishers, or specific file paths. Enforcement can be applied at the operating system level through tools like AppLocker or similar application-control mechanisms. This differs from code signing alone, which verifies that software came from a legitimate publisher but doesn’t by itself prevent unapproved software from running without enforcement. It also differs from blacklist enforcement, which blocks known bad software but doesn’t prevent the execution of unknown threats. Security baselines describe standard configurations, not the specific control of allowing only approved software.