Whitelisting — what it means and how does it work?

You’ve probably heard of blacklisting; surprise, surprise — whitelisting is the opposite of that. It’s a security process in which people can only access a network if they’re on a VIP list of trusted users. If someone can’t prove that they’re on the list, they can’t get into the network.

In an IT context, the whitelisting practice allows approved applications, websites, or IP addresses to operate in a system or network. It is a more trust-centric and secure approach than blacklisting. Whitelisting is like creating a VIP list. Anyone not on the list is not allowed entry to your network or device.

As we’ve said, blacklisting is the opposite of whitelisting. It grants network access to everyone except those on the list of banned users. On the surface, that sounds like a very similar system, but it has its drawbacks. While whitelisting allows you to control and monitor the list of specific users and devices that have access, keeping everyone else out, blacklisting can only protect you from known threats.

Blacklisting and whitelisting are two sides of the same coin. They both indeed protect you from malicious apps, email addresses, IP addresses, and websites. However, they are based on different rules. Blacklists allow everyone except those on the list and whitelists deny everyone except those on the list. So blacklisting is more likely to let a previously unidentified bad actor slip through its defences.

Is one better than the other? You shouldn’t discount blacklisting as most antiviruses are based on this principle. However, whitelists do provide more comprehensive security because their rules are much stricter. There are too many new viruses, vulnerabilities, and threats being discovered every day for blacklists to cut it. And let’s not forget about zero-day vulnerabilities, which don’t see the light of day, yet are loved by hackers. Blacklists do not protect you from them, but whitelists might!

By whitelisting email addresses, you’re telling your spam filters that these senders – and only these senders – are legitimate and whatever they send should be accepted. Such rules can be set by the user, system administrator, or can be outsourced to an external whitelist service provider.

Why whitelist emails? First, it can increase your productivity. No one likes scrolling through a spam folder looking for an important contract they might’ve missed. Second, it could help you prevent phishing attacks. It’s easy to get tricked. Just keep in mind that email whitelisting will make it impossible for new contacts to reach you unless they’re added to the list.

Application whitelisting is a must in high-security environments. By putting applications or executable files on a whitelist, you instruct your device only to run these apps and to consider any other as malicious.

You can also whitelist the behavior of the application, what it “should” do, and block any activity that isn’t allowed. This is great if your device gets infected and someone tries to take over your software because whitelisting won’t let this happen. It will simply shut down the app. In this case, you couldn’t use blacklisting as it would be almost impossible to list all the things your apps “shouldn’t do.”

Application control is sometimes mistakenly used to describe application whitelisting. Application control is a part of application whitelisting, but its rules are more lenient. It will only stop your device from downloading apps that are not on the list, but it won’t stop you from running the app if it was already installed. It also doesn’t check the files’ authenticity. Application whitelisting, on the other hand, monitors your OS and blocks the execution of malicious code and files.

IP whitelisting is great for companies that need security and privacy. Site administrators can set rules for their company’s servers or web servers so that only particular IPs can access them. For example, you might have a corporate application or a server you want to keep private and only allow your employees to access it; then, you would put their IPs on a list. However, their IPs would have to be static for the whitelist to work.

What is a VPN and how can it help with whitelisting an IP? Subscribe to NordVPN to get a dedicated IP. Find out more about static IPs, their pros and cons, and how to get one.

Advertising whitelisting is the process of allowing certain ads to reach the user while blocking all the others. The most common example of advertising whitelisting is ad blockers. Ad blockers block all ads, but you can place certain websites on a whitelist, so the blocker knows to keep showing their ads. This is a great way to support certain websites that you like.

Email whitelisting takes several forms:

Non-commercial whitelisting takes place when someone just wants to block spam emails. In this system, a sender must fit into a specific criteria to pass the whitelisting test. For example, their email should not be open-relay, and they should have a static IP address.

Commercial whitelisting takes place when an internet service provider allows someone to bypass its whitelisting filters and send emails to its users (e.g., spam) for a certain fee. Then such paying entities can be sure that their content will reach the users; they’re buying their place on the whitelist.

Application whitelisting is one of the most popular whitelisting solutions, so we will briefly explain how it works. Users can implement these whitelisting procedures by using third-party software to provide them with a standard predefined or customizable list of apps or services.

Alternatively, the whitelisting can be based on an exemplary operating system, devoid of malware and unwanted software, as a whitelisting model for other systems. This method is quite convenient if a system doesn’t require much customization and uses the same set of applications.

Application whitelisting software analyses various factors to identify acceptable and unacceptable applications (e.g., a file name, size, cryptographic hash, and digital signature). Good whitelisting software should properly evaluate and prioritize them to make sure an app is legit and that hackers won’t trick and bypass the whitelist.

Such software should also analyze the behavior patterns of approved applications to make sure adversaries do not manipulate them. Its databases should also be up-to-date and have the latest info on cryptographic hashes, libraries, scripts, files, etc., and protect you from cyberthreats.

However, whitelisting shouldn’t replace your other cybersecurity measures, and you shouldn’t ditch your antivirus software. They can all work in unison – blacklisting on your whole network and whitelisting on the application level.

Here are a few most common reasons for using whitelisting:

• Whitelisting is highly recommended for large corporations and SMEs, especially ones that need high-security standards or have employees who connect to their network with personal devices;
• Whitelisting can protect you from malware by stopping phishing emails and malvertising from reaching you;
• It can also protect a public device from the installation of insecure software. For example, if a person tries to install malware on a public computer, whitelisting software can block the installation process;
• Whitelisting can help you narrow down the IP and email addresses that can reach you or your website.

Private individuals and smaller organizations can compile their own email and website whitelists. The process will depend on your email provider and the browser you use, but you can easily find step-by-step guides online.

Large corporations are advised to turn to more comprehensive whitelist technologies. Such software can create lists by scanning your network and finding applications you currently use. It also allows you to add websites, apps, or IPs to your list whenever you decide to. Some will also help you to check for the latest updates and will help you track incident responses.

NordVPN’s dedicated IP can help you use whitelisting to keep your business secure.