ASD's Blueprint for Secure Cloud

Application control is a crucial line of defence for protecting enterprises given today’s threat landscape, and it has an inherent advantage over traditional antivirus solutions. Specifically, application control moves away from the traditional application trust model where all applications are assumed trustworthy by default to one where applications must earn trust in order to run. ASD frequently cite application control as one of the most effective means for addressing the threat of executable file-based malware (.exe, .dll, etc.).

Windows Defender Application Control (WDAC) helps mitigate these types of security threats by restricting the applications that users can run and the code that runs in the System Core (kernel). WDAC policies also:

• Enforce Constrained Language mode for Windows PowerShell.
• Enforce the use of drivers signed by Windows Hardware Quality labs and produced by partners who have an Extended Verification certificate.
• Block unsigned and unapproved scripts, MSIs, Universal Windows Store Applications, and .NET applications.

To reduce management overhead, WDAC enables the use of managed installers; such as Microsoft Endpoint Configuration Manager. When configured, items deployed via the managed installer are added into the allow list.

When deploying WDAC it is important that it is deployed utilising audit mode prior to enforcement.

Related information

Security & Governance

• User application hardening
• Application Control
• Essential Eight: Restrict Microsoft Office Macros

Design

• None identified

Configuration

• ASD Windows Hardening Guidelines

References

• None identified