Allow List - Deny List

Updated 31 Jul 2026

•
def
- •
  security policy controlling which applications are permitted to run, since any application can be dangerous (vulnerabilities, trojan horses, malware)
•
types
- •
  allow list — nothing runs unless it's been explicitly approved; very restrictive
- •
  deny list — nothing on the "bad list" can be executed (the model anti-virus/anti-malware traditionally use)
•
related
- •
  Technical Change Management
•
cards
- •
  Distinguish an allow list from a deny list
  - •
    Allow list: nothing runs unless explicitly approved (very restrictive); deny list: nothing on the 'bad list' can run (the traditional anti-virus model)

Linked references 3