An allowlist (formerly called a whitelist) is a list of explicitly approved applications, users, IP addresses, domains or other entities; everything not on the list is blocked by default.
How allowlists work
An allowlist reverses the usual approach of a blocklist. Instead of trying to list everything bad, it permits only what is known to be good – a “default deny” model. Common uses:
- Application allowlisting – only approved programs, scripts and drivers may run, identified by publisher certificate, file hash or path. Windows offers AppLocker and App Control for Business (WDAC); NIST described the approach in SP 800-167.
- Network allowlists – firewall rules that allow only specific IP addresses or ports, for example limiting SSH or admin panels to a VPN.
- Email and web allowlists – trusted senders and domains that bypass certain filters.
- Input validation – accepting only expected characters or values in applications.
Many organisations, including the UK NCSC since 2020, use the terms allowlist and blocklist instead of whitelist and blacklist.
Why allowlists matter
Application allowlisting stops most unknown malware, including new ransomware, because unapproved executables simply cannot start. The Australian Signals Directorate’s Essential Eight lists application control among its core mitigation strategies. It also supports the principle of least privilege.
The challenges are maintenance and gaps. Lists must be updated whenever software changes, and attackers try to abuse programs that are already allowed – PowerShell, mshta or signed drivers – a technique known as living off the land. Overly broad rules, such as allowing whole user-writable folders, undermine the protection.
Best practices
- Start in audit mode to learn what runs in your environment.
- Prefer rules based on publisher signatures and hashes over paths.
- Block known abusable system binaries that users do not need.
- Review allowlists regularly and remove stale entries.
