Application and Data Protection · Topic 1 of 4
Application Control, Sandboxing, Patching and WAF
Control which applications run with whitelisting and blacklisting, isolate them in sandboxes, patch on schedule and filter web traffic with a WAF.
- 4 min
- Whitelisting is default deny, blacklisting is default allow.
- Whitelist rules can use publisher, path or hash. Publisher is the most flexible and path the weakest.
- A sandbox isolates, a WAF filters Layer 7 web traffic.
What it is
Applications are how attackers get in and how users get work done. Four controls address that: application control decides what may run, sandboxing isolates what runs, patch management removes known flaws and a web application firewall (WAF) filters traffic to web applications.
How it works
Application whitelisting and blacklisting
| Approach | Rule | Strength | Weakness |
|---|---|---|---|
| Whitelisting (allowlist) | Only approved applications run. Everything else is blocked. | Stops unknown and new malware | Needs upkeep when software changes |
| Blacklisting (blocklist) | Known bad applications are blocked. Everything else runs. | Easy to start | Cannot stop malware not yet on the list |
Whitelisting is a default deny model and blacklisting is default allow. Whitelisting is stronger but harder to run, and it suits servers and fixed function machines best.
Rules can identify an application by its publisher (digital signature), its file path or its file hash. Publisher rules survive updates, hash rules are exact but break at every update, and path rules are weakest because attackers can drop files into allowed folders. Examples of enforcement: AppLocker and App Control for Business on Windows, and SELinux or AppArmor profiles on Linux. A good rollout starts in audit mode, reviews what would be blocked and only then enforces.
Application sandboxing
A sandbox is an isolated environment where a program runs with limited access to files, memory, network and the rest of the system. If the program is malicious or exploited, the damage stays inside the sandbox.
Uses: browsers isolate each tab and plugin, mobile operating systems sandbox each app, and email gateways detonate unknown attachments in a sandbox to watch their behavior before delivering them. Related technologies are containers, virtual machines and tools such as Windows Sandbox.
Limits: advanced malware can detect a sandbox and stay quiet, and a sandbox escape flaw can break out of it. Sandboxing reduces risk but is not a substitute for patching.
Application patch management
Applications (browsers, PDF readers, Java, office suites, databases) are attacked as often as the OS.
- Inventory all applications and versions.
- Monitor vendor advisories and vulnerability feeds (for example CVE entries).
- Prioritize by severity and exposure, such as internet facing and actively exploited flaws first.
- Test the patch in a staging environment.
- Deploy in stages with a rollback plan, using software distribution tools.
- Verify with scans and reports.
- Remove end of life software that no longer gets patches.
Web Application Firewall (WAF)
A WAF works at Layer 7. It inspects HTTP and HTTPS requests and responses and blocks attacks on web applications, such as SQL injection, cross site scripting (XSS) and other items in the OWASP Top 10. A network firewall only looks at addresses and ports, so it cannot see these.
| Aspect | Detail |
|---|---|
| Placement | Reverse proxy in front of the web server, in the network, on the host, or as a cloud service |
| Negative security model | Block requests that match known attack signatures |
| Positive security model | Allow only requests that match what the application expects |
| Modes | Detection (log only) and prevention (block) |
| Rule sets | For example the OWASP Core Rule Set, used with ModSecurity |
| Extras | Rate limiting, bot protection, virtual patching of a known flaw |
For HTTPS, the WAF must see the decrypted traffic, so it either terminates TLS or sits where traffic is decrypted. Virtual patching applies a WAF rule to stop an exploit while the code fix is being prepared.
A worked example
A bank runs payment servers with application whitelisting based on publisher signatures. A new tool is requested and approved before being allowed. A customer portal sits behind a WAF in prevention mode, which blocks a request that contains an SQL injection string. A critical flaw in the web framework is covered by a WAF rule while developers test the patch.
How the exam asks about this
- "Which approach allows only approved programs and blocks everything else?" → Application whitelisting.
- "Which device inspects HTTP traffic to stop SQL injection and XSS?" → A web application firewall.
- "Where can suspicious files be run safely to observe their behavior?" → In a sandbox.
What to remember for the exam
- Whitelisting is default deny, blacklisting is default allow.
- Whitelist rules can use publisher, path or hash. Publisher is the most flexible and path the weakest.
- A sandbox isolates, a WAF filters Layer 7 web traffic.
- WAF models: positive (allow expected) and negative (block known bad).
- Patch process: inventory, prioritize, test, deploy, verify.
A WAF does not replace secure code or patching. It is an extra layer, and virtual patching is temporary.
Common mistakes
Choosing a network firewall for web attacks. SQL injection is inside allowed HTTP traffic. Only a WAF inspects it.
Enforcing whitelisting on day one. Without audit mode first, legitimate applications are blocked.
Forgetting third party applications. Browser plugins and utilities are patched less often and attacked often.
Check yourself
Why is whitelisting stronger than blacklisting?
It blocks anything not approved, including malware that is brand new and on no list.
What is virtual patching?
A WAF rule that blocks exploitation of a known flaw until the real patch is applied.
What is a sandbox for?
Running untrusted code in isolation so any damage is contained.
Topic 1 of 4 in Application and Data Protection
Test yourself on Application and Data Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.