NIST SP 800-167 Guide to Application Whitelisting

Section 3: Planning and implementation of application whitelisting – NIST SP 800-167 Guide to Application Whitelisting

NIST SP 800-167 Guide to Application Whitelisting 3.2c: Choose trusted publishers, users and updaters carefully

What does 3.2c require?

The trusted entities that may change whitelists (publishers, users, updaters and sources) are chosen deliberately, because a compromise of a trusted entity compromises the whitelisting technology and every host it protects, while failing to trust a necessary entity such as the patch installer causes operational failure.

Maintained by Gerard Blokdyk

Other controls in Section 3: Planning and implementation of application whitelisting – NIST SP 800-167 Guide to Application Whitelisting

3.1a Define application whitelisting requirements and capture the decisions in policy
3.1b Document requirements for the whitelisting technology itself
3.1c Cover every end user device type, with a waiver and risk process for platforms that cannot be whitelisted
3.2a Use validated cryptography for hashing, signature validation and management traffic, and plan for algorithm change
3.2b Design the centrally managed architecture for placement, redundancy, reliability and interoperability
3.3a Prototype test functionality, management, logging, performance and the security of the implementation
3.3b Scan for malware and secure the host before installing the whitelisting agent
3.4 Deploy gradually, starting with a small number of hosts, and prepare staff and users

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NIST SP 800-167 Guide to Application Whitelisting controls