How to maintain and enforce an approved list of software?

Question

I work in a software-development company where we have a lot of tech-savvy people. For ISO27001 certification we need to maintain list of approved software. And I'd like to understand how in practice this list is maintained and enforced?

The problem is that, we can define the list of the main tools used in the company there. But besides these big products like MS Office, Visual Studio etc there is a whole bunch of small tools like tools from Sysinternals, rootkit finders, browser plugins, plugins for VSCode, 3rd party libraries used by developers, scripts which are written internally or downloaded form the internet etc. For linux servers, there are also thousands tools available from the official repos. On windows people can run any portable tool even without admin rights.

Another aspect is how to practically enforce this list on laptops and on servers. The portable tools don't require admin rights to run, quite a few users have admin rights as they need for work.

For me it looks impractical to maintain list of all these small bits and pieces and I'd like to understand where to draw the line. The systems need to be secure but usable at the same time and we should not slow down work for the employees as well.

I'm thinking of:

1. defining list of the main categories of the tools and ask users to use only approved tools from defined categories. And for all small tools - state that users are responsible for security validation of the tool (antivirus check, download from trusted/known source, review of the script before execution etc).
2. For linux servers - allow everything from official repositories
3. For windows servers - allow installation only to admins (in place) and on terminal servers - use whitelisting for the programs by hash.

• What are the best practices to implement and enforce the list of approved software?
• How do you make sure that the list is valid?
• How do you enforce the list?

Answer 1

There are really two questions here. If you're looking at how to actually enforce the use of approved software only, you need to application whitelisting (using something like AppLocker) to only allow binaries with specific hashes to be run. You then need to test and verify every update or new version, and have monitoring in place to detect admins doing things they shouldn't and overriding your rules. Unless you're operating at TOP SECRET, this is probably impractical overkill.

---

If you're looking to put something in place that will let you pass ISO 27001, you can be a bit more open, but need to support it with policies. A common approach here would be to:

• Ensure that your users don't have admin rights
• Use AppLocker (or something similar) to only allow them to execute binaries from C:\Program Files and C:\Windows

You then need a policy to say that your admins won't override the rules (except in edge cases where this is allowed and documented), and to have processes to:

• Review software and decide whether it's "approved" based on some criteria you define.
• Allow users to request new software be added to the list
• Maintain a list based on the above
• Install this software on users' computers (or have a self-service platform like SCCM)
• Deploy patches and updates to users
• Handle exceptions and edge cases where users (or more frequently administrators) need to run something that's not on the approved list based on a risk assessment of the software.
• Carrying out regular reviews to identify policy breaches (such as vulnerability scanning, asset/inventory scanning, or random auditing)

In terms of how you decide what is approved, that will depend on the requirements of the business. But it would often include things like:

• Is it fully patched?
• Are there any known vulnerabilities?
• Is it still supported? Is commercial support available?
• Can we legally use it (commercial licenses, compatible open source ones, etc)?
• Is it written by a trusted company/developer?
• Is it from a hostile nation?
• Has it undergone security testing?
• Does the developer follow secure development practices?

You can also look at outsourcing some of the work to reduce the overhead of managing software versions. This could be doing something like certificate-based validation (e.e, everything signed with the "Microsoft" code signing cert is allowed), or through "trusted" installation methods (e.g, everything in the app store is allowed).

It's not 100% bulletproof, but you should be able to find a balance that your auditor will be happy with, and that doesn't cause too much overhead and disruption.