Whitelisting is when you identify people, brands, documents, or services that should get special recognition, privileges, or access. Think of it like a VIP guest list at a high-end nightclub. If your name is on the list, you get to bypass the waiting line and go straight to the VIP area.
It works the same way in computing. Let’s say one of the programs on your computer regularly needs to do cloud lookups for updates and information, but your firewall keeps alerting you every time the program tries to communicate with the web. You might create a whitelist entry in your firewall to ensure that the program has the access it needs, and to prevent your firewall from bothering you with alerts on a legitimate communication. Similarly, you can whitelist trusted senders in your email client to ensure that important messages don’t end up in your SPAM or junk folder. Or, if you use any kind of parental controls software on your computer, you could whitelist certain educational websites but block everything else, ensuring that your family is only able to reach approved internet content.
In contrast, a blacklist achieves the opposite. Blacklists are lists that identify malicious people, brands, documents, and services that should be blocked or handled carefully. In general, whitelists and blacklists are very useful to help filter out bad or unwanted content, messages, and programs, and ensure that only legitimate or approved content, messages, and programs are viewed or run. In addition to the personalized lists you can create on your own machine, many companies across numerous industries, including cybersecurity vendors and internet service providers, use both public and proprietary whitelists and blacklists. As an example, if your email is provided by your internet service provider, chances are they use some kind of whitelist/blacklist to filter the emails you receive and protect you from SPAM and phishing attempts.
One thing to note about whitelists and blacklists is that they have to be updated constantly, or else they can get out of date very quickly. Hypothetically speaking, a legitimate website could get hijacked to deliver malware for a few hours. Up until that moment, that website has had a great reputation as a legitimate site, so there’s no reason for it to get blocked. By the time anyone catches onto the fact that the site has been hijacked, the hijackers themselves could’ve removed the malicious code and moved on. In that case, only a whitelist/blacklist that uses real-time, up-to-the-minute analysis would be able to detect the website’s change from good to bad and back again.
