Application Control Technologies for Essential 8: A Comparative Guide

Application control is a core component of the Australian Cyber Security Centre’s (ACSC) Essential 8 mitigation strategies. By restricting which applications can run in your environment, you significantly reduce the risk of malware infections and unauthorized software. Several technologies can be used to achieve this, including AppLocker, Windows Defender Application Control (WDAC), ThreatLocker, and Airlock Digital. This post compares them against the maturity levels, gives a pricing guide, and rates both the implementation effort and the operational management involved.

The Essential 8 and application control

The Essential 8 framework defines three maturity levels for cybersecurity:

• Level 1: Basic cyber hygiene, designed to protect against opportunistic cyber threats.
• Level 2: Increased protection to defend against more targeted attacks.
• Level 3: Advanced protection, aimed at mitigating sophisticated cyber threats.

Application control is one of the primary strategies for each maturity level, becoming more stringent as you move from Level 1 to Level 3.

The comparison, up front

Maturity level coverage

AppLocker is the only one of the four that does not comfortably reach Level 3. It will get you to Level 2, but it lacks the flexibility and the advanced features the higher level asks for.

Cost and effort

Both scales run from 1 to 5. For implementation effort, 1 is minimal effort and 5 is high effort. For ongoing management, 1 is easy to manage and 5 is difficult to manage.

The two free options are the two most expensive to run. That is the trade this table is really showing: WDAC costs nothing to licence and the most to operate, while Airlock costs the most per endpoint and the least in staff time. Which of those is cheaper depends entirely on what an hour of your team’s time is worth.

Pricing and product capabilities were correct as at September 2024. Vendors change both. Confirm current figures before you build a business case on them.

The four solutions in detail

AppLocker

AppLocker is a built-in Windows feature that allows administrators to control which applications and files users can run. It operates by setting rules based on file attributes, such as file path, file publisher, and hash values.

It meets Level 1 by providing basic application whitelisting, and meets Level 2 but requires more complex rule sets to do it. It may struggle to meet Level 3, as it lacks the flexibility and advanced features found in the other solutions.

Rule creation can be time-consuming in a large environment. Once rules are in place, maintenance means periodic updates, which stays manageable until the number of rules grows.

Windows Defender Application Control (WDAC)

WDAC is a more advanced application control feature also built into Windows. It provides stronger enforcement by using kernel-mode policies and supports richer rule sets.

It meets Level 1 with ease, meets Level 2 with more comprehensive control than AppLocker, and meets Level 3, offering the level of security and customizability sophisticated environments require.

Policy creation is more complex than AppLocker’s and requires a solid understanding of Windows security. Managing those policies is equally demanding, because of how deeply WDAC integrates with the Windows kernel. Updating and troubleshooting both need someone who knows the system well.

ThreatLocker

ThreatLocker is a third-party application control solution that uses default deny policies, allowing organizations to whitelist specific applications while blocking all others. It also provides endpoint protection features beyond just application control.

It easily meets Level 1 with its default-deny approach, meets Level 2 with more flexibility in policy creation, and meets Level 3 with granular control and the ability to handle sophisticated, targeted attacks.

The interface is intuitive, but implementation still takes time for policy configuration. Ongoing management is straightforward at first and becomes more involved as new applications and updates arrive in the environment.

Airlock Digital

Airlock Digital is a specialized application whitelisting solution specifically designed for Essential 8 compliance. It provides a high degree of automation to simplify the process of whitelisting applications, especially in large and complex environments.

It easily meets Level 1 with automated controls, meets Level 2 with robust application control capabilities, and is well suited to Level 3, having been designed with a focus on high-level security.

Features like automatic application discovery reduce setup time. The automation also cuts the day-to-day burden considerably: software updates and new application requests are handled for you.

Conclusion

Each application control solution offers unique benefits and is suited to different levels of complexity and operational needs. AppLocker is a good entry-level solution but may struggle with more complex environments. WDAC provides stronger security but requires significant effort to manage. ThreatLocker offers robust application control with a balance between ease of use and flexibility. Airlock Digital is ideal for organizations looking for automation and seamless compliance with the Essential 8, especially for Level 3.

Choosing the right tool depends on your organization’s needs, resources, and the complexity of your IT environment. For those looking for easy management with advanced security, Airlock Digital is a great choice, while ThreatLocker and WDAC provide solid options for more custom environments. AppLocker, though free, may be limited for higher levels of maturity.

Element Digital offers IT Consulting Services in Hobart, dedicated to providing expert guidance and strategic planning for all your IT needs. Our Hobart-based IT Professional Services are tailored to meet the diverse requirements of businesses in Tasmania. For more insights and updates, follow us on LinkedIn and stay connected with #ElementDigital.