System, Method, and Apparatus for Enhanced Blacklisting

A system for computer security, the system comprising:

• a target computer;
• computer security system software stored in non-transitory storage of the target computer;
• the computer security system software running on the target computer;
• a blacklist accessible by the computer security system software, the blacklist containing entries indicative of which programs are not allowed to run on the target computer;
• a whitelist accessible by the computer security system software, the whitelist containing entries indicative of which programs are allowed to run on the target computer;
• when a program attempts to execute on the target computer, the computer security system software determines whether the program is in the blacklist and whitelist, when the program is not in the blacklist or is in the blacklist and in the whitelist, the computer security system software running on the computer allows the program to run;
• when the program is in the blacklist and in not in the whitelist, the program is prevented from running and data regarding the program is captured and stored;
• after the program is prevented from running, a set of rules determines if the program is within a program classification and when the program is within the program classification, administrative software presents a user interface for an administrator that includes the program classification, upon receiving an acceptance of the program classification, the administrative software adds an override entry to the whitelist that will allow future execution of the programs in the program classification;
• otherwise, the administrative software presents a second user interface for the administrator that requests approval solely for the program and upon the acceptance, the administrative software either updates the blacklist to remove an entry for the program or updates the whitelist to add the entry for the program;
• and
• otherwise, the blacklist is not updated and future attempts to run the program will be blocked.

A method of protecting a target computer, the method comprising:

• upon a program attempting to be run on the target computer, determining whether the program is allowed to run based upon a blacklist and a whitelist, the program is allowed to run based upon the program being absent from the blacklist or the program is allowed to run based upon the program being present on the blacklist and present on the whitelist, thereby allowing the program to run on the target computer;
• otherwise, when the program is present on the blacklist and absent from the whitelist, preventing the program from running and storing data regarding the program;
• later, retrieving the data regarding the program and if the data indicates that the program is within a program classification, requesting approval to allow future executions of all of the programs in the program classification, and upon the approval, adding an override entry to the whitelist, thereby enabling future execution of all programs in the program classification;
• otherwise, requesting the approval to allow the future executions of only the program and if allowed, either removing an entry from the blacklist or adding the entry in the whitelist, thereby allowing the future execution of the program;
• and
• otherwise, not allowing the future executions of the program.