Ransomware, Solarwind, Exchange Server ... it always takes software or hardware that can be used as a springboard for an attack and then, of course, software that carries out the attack. Pure whitelisting of applications has proven to be very costly and not very practical - and does not allow control of the applications' little siblings: macros, embedded scripts, etc. In order to be able to securely protect oneself against attacks, one must also bring these small accessories under control.
It is therefore no longer sufficient to look only at the applications on the server and client. So what needs to be done to separate good from evil - or is it rather a question of intentional and unintentional? Since it is not only at the point of execution at start-up that checks must be made, but also the "influx" of executable objects that provide meaningful answers to wanted or not wanted, it is clear that the use of several components at different points in the IT environment makes sense. These different components add up to a complete solution to the problem of "secure application use".
These components of the complete solution, which could be called Next Generation Application Control (NGAC) (and is called CodePurITy at itWatch), provides an answer to the question "how does the secure use of applications work". It is presented in the article. The details of its use and the experience gained will follow in the article "Recognise, qualify and securely use all executable objects/applications everywhere: how does that work?