Why software restriction policies?
There are many ways hostile code can get onto your system.
As internet use increases for daily business computing, the potential for hostile code getting its way onto your systems is higher than ever before. People are using more ways to work, instant messaging, e-mail, cloud services, peer to peer applications. As these useful technologies increase so does the risk of your network becoming infected with viruses, worms Trojans or any other hostile code. Always bear in mind that E-mail and instant messaging can transport hostile code, which doesn’t have to be an executable (.exe) it can be a Word document or image (.jpeg) for example.
Viruses and worms often use social engineering to get a user to activate them. With the number of different types of malicious code out there users have a difficult task in knowing what is safe and what is not. When this code is activated it can damage content, flood a network resulting in downtime, use your network or systems for illegal activity or maybe simply steal your data. None of which are desirable!
Hostile code is not the only threat there are a number of non-malicious programs which can cause issues for a business, by creating conflict or crashing systems by changing configuration information for example.
This is why software restriction is such an important and great tool to a business network. It allows you to specify exactly which code you will allow users to run or not. Mitigating the risk of something malicious getting onto your systems.
Software restriction policies help business respond to unknown code by:
Providing a way to define a whitelist of what is trusted and what is not.
Providing a flexible, policy based approach for regulating scripts, programs or ActiveX controls.
Possibly my favourite is that these policies are enforced automatically, so whilst setting them up can be time consuming once it is done that is it. So it is great for the small business or small IT department.
For more information on how to set these up check out this TechNet article: https://technet.microsoft.com/en-us/library/hh994606.aspx