Editorial Update
This presentation used the word whitelist to describe a list that allows an application to run and blacklist to describe applications that can't run. I no longer have access to the source material for this presentation, and so it's presented in its original form. Where possible however, these words have been replaced with allowlist and denylist. These are both more accurate words and more inclusive.
Introduction
This is the slide deck presented at BSides CHS on November 11 2017.