First, a disclaimer: I work for application whitelisting pioneer, CoreTrace.

With that said, I agree with almost all of the application whitelisting pros/cons you cited in your blog. Almost all whitelisting solutions stop unauthorized applications. Good ones stop attacks within whitelisted applications (e.g., memory-based attacks within whitelisted applications). Really good ones (which are very rare) can handle dynamic environments like desktops and laptops without increasing costs as you described. CoreTrace created a concept called “Trusted Change” that enables IT to establish multiple sources of trust in advance (trusted updaters, trusted digital certificates, even trusted browser plugins like ActiveX). As long as users and systems operate within these pre-defined broad sources of trust, they don’t even know the protection is there and IT doesn’t need to be a bottleneck. Other leading players are working on their version of the same.

Simply put, we all know that application whitelisting cannot become the foundational anti-malware technology until the operational friction is as low as blacklist-based antivirus–and we won’t rest until we have proven it to leading CIOs like you.

Thanks again for raising the issue.