Running PowerShell securely
PowerShell has several features that actively increase the security of our environments. Let’s start by looking at application control.
Application control
Application control solutions prevent unauthorized applications from running. There are third-party applications, such as Trellix, but Windows 10 and later come with two built-in applications – Windows Defender Application Control (WDAC) and AppLocker. These can be used to create policies that enforce a whitelist of applications that are allowed to execute and prevent anything else from running. AppLocker is no longer under development, so WDAC is recommended. These solutions are intended for an enterprise environment and allow for centralized control. I am not aware of any solutions that work with PowerShell on Linux or macOS. When PowerShell runs under a default WDAC policy, then trusted modules and scripts are granted more access than untrusted ones, using a feature called language...