What is application control?
Where it stops an attack.
- The attack A phishing email drops a program into a user’s Downloads folder and tries to run it.
- Stopped here The program isn’t on the approved list, so Windows refuses to run it.
- The result No ransomware, no stolen passwords, no back door.
Application control maturity levels
What changes at each level.
What changes ML1 Maturity Level 1. ML2 Maturity Level 2. ML3 Maturity Level 3.
Where it runs WorkstationsAdds internet-facing serversAdds all other servers
What it controls Programs, scripts, installers, libraries and other executable files No change
Adds drivers
Locations covered User profiles and temporary foldersEvery location No change
Microsoft blocklists Not required
Recommended application blocklistAdds the vulnerable driver blocklist
Rules reviewed Not required
At least once a year No change
Logging Not required
Allowed and blocked events logged centrally. Internet-facing server logs analysedAdds analysis of workstation and internal server logs
Each level includes everything in the one before. A plain-English summary, not the requirement text. ASD Essential Eight Maturity Model (November 2023)
How to implement application control
Protection first, disruption last.
- 01
Run in audit mode first
Record every application, script and installer the business uses before blocking anything. - 02
Build the allowlist
Allow by publisher certificate where possible, so routine vendor updates don’t break. - 03
Enforce in waves
Start with one team, fix what breaks, then roll out to the rest. - 04
Handle exceptions by ticket
A quick request process for new software, so nobody works around the control.
Common application control mistakes
Where rollouts go wrong.
-
Going straight to enforce
Skipping audit mode is how a line-of-business app stops working on a Monday.
-
Allowing folders users can write to
If staff can write there, so can malware.
-
Set and forget
Software changes. The rules need an owner.
Is application control the same as antivirus?
No. Antivirus blocks software it knows is bad. Application control only allows software you have approved, so it stops threats antivirus hasn’t seen yet. You need both.
Can we do application control with Microsoft 365?
Yes. Microsoft 365 Business Premium includes Intune, which deploys Windows Defender Application Control and AppLocker policies to managed devices.
How long does an application control rollout take?
Six to ten weeks for a typical 50-seat business: two weeks of audit mode, two of tuning, then enforcement team by team.