NIST SP 800-167 Guide to Application Whitelisting
Section 2: Application whitelisting technology: threats, types, modes, uses and evaluation – NIST SP 800-167 Guide to Application Whitelisting

NIST SP 800-167 Guide to Application Whitelisting 2.2.3: Generate the whitelist from a clean baseline or vendor data and maintain it through trusted updaters

What does 2.2.3 require?

The initial whitelist is built from vendor-supplied characteristics of known good applications plus the organisation's own records for in-house software, or by scanning a clean host (a freshly built, fully patched image never touched by end users) to form the baseline. Because patches and new applications otherwise appear as unknown software, the organisation designates trusted updaters (such as patch management), trusted publishers, trusted users and trusted sources whose changes are added automatically, and may use reputation services to decide how new or modified files are treated instead of sending them all to a greylist for manual handling.

Maintained by Gerard Blokdyk

Other controls in Section 2: Application whitelisting technology: threats, types, modes, uses and evaluation – NIST SP 800-167 Guide to Application Whitelisting

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-167 Guide to Application Whitelisting controls