An organization implements application whitelisting on endpoints. Users report that legitimate business applications are being blocked. What is the MOST effective approach to managing exceptions while maintaining security?
Select an answer to reveal the explanation.
Short Explanation
You need a structured exception process because it lets users request blocked applications while security validates legitimacy and business need before whitelisting them. This keeps the whitelist intact while fixing real usability problems.
Full Explanation
The structured exception process is correct because it balances usability with security by ensuring each exception is reviewed, documented, and only granted for legitimate business needs. This maintains whitelist integrity while accommodating real requirements. Disabling application whitelisting for users who report blocking incidents is wrong because it defeats the security control for those endpoints. Switching entirely to a blacklist approach is wrong because blacklisting requires knowing all bad applications in advance and misses zero-day and novel malware. Allowing all applications signed by any valid code-signing certificate from any CA is wrong because malware is frequently signed with stolen or fraudulently obtained code-signing certificates.