How is application whitelisting different from application blacklisting?

Application whitelisting is a "default-deny" security posture. It works by maintaining a list of approved or trusted applications that are explicitly authorized to be present and active on a system. Any application not on this list is blocked from executing. This contrasts with application blacklisting, which is a "default-allow" approach that only blocks known malicious or undesirable applications, allowing all others to run. Option D accurately describes the fundamental mechanism of whitelisting.

Option A describes application blacklisting, where all applications are allowed except for a specific list of undesirable ones.
Option B is too general; while whitelisting does involve trusted applications, its defining characteristic is the default-deny mechanism.
Option C describes sandboxing or application isolation, a different security technique for running untrusted code in a restricted environment.

1. Souppaya, M., & Scarfone, K. (2015). Guide to Application Whitelisting. National Institute of Standards and Technology (NIST), Special Publication 800-167. https://doi.org/10.6028/NIST.SP.800-167. (See Section 2.1, "Application Whitelisting Technologies").

2. University of California, Berkeley. (n.d.). Application Whitelisting. Information Security Office. Retrieved from https://security.berkeley.edu/education-awareness/application-whitelisting. (See "What is Application Whitelisting?" section).

3. Australian Cyber Security Centre (ACSC). (2022). Implementing Application Control. Australian Government. Retrieved from https://www.cyber.gov.au/acsc/view-all-content/publications/implementing-application-control. (See "What is application control?" section).