I work in a software-development company where we have a lot of tech-savvy people. For ISO27001 certification we need to maintain list of approved software. And I'd like to understand how in practice this list is maintained and enforced?
The problem is that, we can define the list of the main tools used in the company there. But besides these big products like MS Office, Visual Studio etc there is a whole bunch of small tools like tools from Sysinternals, rootkit finders, browser plugins, plugins for VSCode, 3rd party libraries used by developers, scripts which are written internally or downloaded form the internet etc. For linux servers, there are also thousands tools available from the official repos. On windows people can run any portable tool even without admin rights.
Another aspect is how to practically enforce this list on laptops and on servers. The portable tools don't require admin rights to run, quite a few users have admin rights as they need for work.
For me it looks impractical to maintain list of all these small bits and pieces and I'd like to understand where to draw the line. The systems need to be secure but usable at the same time and we should not slow down work for the employees as well.
I'm thinking of:
- defining list of the main categories of the tools and ask users to use only approved tools from defined categories. And for all small tools - state that users are responsible for security validation of the tool (antivirus check, download from trusted/known source, review of the script before execution etc).
- For linux servers - allow everything from official repositories
- For windows servers - allow installation only to admins (in place) and on terminal servers - use whitelisting for the programs by hash.
- What are the best practices to implement and enforce the list of approved software?
- How do you make sure that the list is valid?
- How do you enforce the list?