Allow
Approved apps run, with elevation or permission to start child processes where policy allows.
Where the module helps during an attack
Application control primarily acts when unknown code attempts to run. This is an indicative view, not a measurement.
| Area | Level |
|---|---|
| Reconnaissance | no direct role |
| Initial access | context |
| Execution and persistence | primary role |
| Escalation and lateral movement | additional protection |
| Impact | context |
| Investigation and recovery | context |
Run only what you approve
Antivirus looks for malicious software. Application Control defines what may run and blocks or requests approval for the rest, including tools antivirus may not classify as malicious.
Heimdal calls this AppFencing. It enables zero-trust execution policies and limits processes that could support lateral movement.
Block
Unapproved processes are terminated and the attempt is recorded in the console.
Audit mode
Passive mode records launches without blocking, providing the basis for policies.
Every launch is checked against policy
Rules are configured in the Heimdal console. The agent checks each process launch against them. Default decisions accelerate approvals, with custom workflows for users or Active Directory groups.
Allowed, blocked and monitored launches remain in an audit trail. The vendor states a 90-day retention period.
- Rules by name, path, publisher, MD5, signature or wildcard path.
- Control over whether processes may launch child processes.
- PEDM integration for automatic elevation of approved apps.
For workplaces that need control over running software
The module helps businesses where users install their own tools or where software execution must be documented. It also suits standardised workstations with stable application lists.
It works best alongside removal of standing admin rights through PEDM, reducing opportunities to bypass rules.
Security
Less unknown code and control over tools that could be abused.
Operations
A clear approved software list and faster policy-based approvals.
Audit
Records of what ran, where and what was blocked.
Deployment with APPSEC: observe first, then block
Heimdal supplies the module and technology. APPSEC designs and deploys rules as agreed. You approve the software allowlist and exceptions.
Audit mode
We enable passive mode to discover applications actually in use.
Rule design
We build policies from collected data using publishers, paths and user groups.
Gradual blocking
We enable blocking by group and monitor work impact.
Approval process
We agree how users request new apps and who approves them.
Things to consider
- The vendor recommends the module for workstations and advises against server deployment because of potential high CPU load.
- The vendor compatibility matrix lists Windows and macOS, not Ubuntu.
- A new blocking rule does not terminate an already running process. It applies at the next launch.
- Licensing counts devices with active rules, including audit mode.
