CM-07(05) Authorized Software — Allow-by-exception
All changes in this version
Title
Authorized Software — Allow-by-exception
Control
(a) Identify [Assignment: software programs];
(b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and
(c) Review and update the list of authorized software programs [Assignment: frequency].
Discussion
Authorized software programs can be limited to specific versions or from a specific source. To facilitate a comprehensive authorized software process and increase the strength of protection for attacks that bypass application level authorized software, software programs may be decomposed into and monitored at different levels of detail. These levels include applications, application programming interfaces, application modules, scripts, system processes, system services, kernel functions, registries, drivers, and dynamic link libraries. The concept of permitting the execution of authorized software may also be applied to user actions, system ports and protocols, IP addresses/ranges, websites, and MAC addresses. Organizations consider verifying the integrity of authorized software programs using digital signatures, cryptographic checksums, or hash functions. Verification of authorized software can occur either prior to execution or at system startup. The identification of authorized URLs for websites is addressed in [CA-3(5)](#ca-3.5) and [SC-7](#sc-7).
Parameters
cm-07.05_odp.01: software programs
cm-07.05_odp.02: frequency
Related controls
cm-10, cm-2, cm-6, cm-8, pl-9, pm-5, sa-10, sc-34, si-7
STIG rules that implement this control 14
Application Security and Development V6R5
- APSC-DV-001490 CAT II The application must employ a deny-all, permit-by-exception (whitelist) policy to allow the execution of authorized software programs.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-431010 CAT II Ubuntu 22.04 LTS must have the "apparmor" package installed.
- UBTU-22-431015 CAT II Ubuntu 22.04 LTS must be configured to use AppArmor.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100500 CAT II Ubuntu 24.04 LTS must have AppArmor installed.
- UBTU-24-100510 CAT II Ubuntu 24.04 LTS must be configured to use AppArmor.
Microsoft Edge V2R5
- EDGE-00-000042 CAT III Extensions that are approved for use must be allowlisted if used.
Microsoft Windows 11 V2R11
- WN11-00-000035 CAT II The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
Microsoft Windows Server 2022 V2R11
- WN22-00-000080 CAT II Windows Server 2022 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
Microsoft Windows Server 2025 V1R4
- WN25-00-000080 CAT II Windows Server 2025 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200600 CAT II RHEL 10 must have the "fapolicy" module installed.
- RHEL-10-200601 CAT II RHEL 10 must enable the "fapolicy" module.
- RHEL-10-200602 CAT II RHEL 10 must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-433010 CAT II RHEL 9 fapolicy module must be installed.
- RHEL-09-433015 CAT II RHEL 9 fapolicy module must be enabled.