NIST SP 800-167 Guide to Application Whitelisting 2.2.1a: Never rely on file path, filename or file size as the only attribute

What does 2.2.1a require?

Simple attributes are not used on their own. A path is only acceptable as a basis when strict access controls let only authorised administrators add or change files in it; a filename is always paired with another attribute because an infected or planted file keeps its name; and file size is replaced by a signature or hash wherever feasible because an attacker can match the length of a benign file.