Framework: The Center for Internet Security (CIS) Top 18 Controls

The remaining safeguards under Control 2 emphasize automation, enforcement, and continuous verification of software integrity. Safeguards 2.3 through 2.7 outline the operational lifecycle for managing software once the inventory and authorization baselines are established. They include removing or documenting exceptions for unauthorized software, using automated tools to detect installations, and deploying allowlists for approved applications, libraries, and scripts. These technical measures transform software management from a reactive audit activity into a proactive defense mechanism. By automating discovery and enforcement, enterprises close the window between when new software appears and when it is evaluated. Automated systems can detect unauthorized executables in near real-time and quarantine them before they become exploitation vectors. Combined with periodic reviews, these safeguards ensure that every running process supports an approved and supported purpose within the enterprise.

Implementing these safeguards also advances operational maturity. Application allowlisting—once considered complex—has become practical through modern endpoint protection suites and operating system capabilities. Organizations can now approve software by digital signature, hash, or path, providing granular control without paralyzing user productivity. Similarly, controlling libraries and scripts prevents adversaries from exploiting trusted processes to execute malicious code, a common tactic in supply chain and fileless attacks. These measures also integrate seamlessly with development and DevOps environments, where code integrity verification is essential. Regular reassessment of authorized software and its components ensures continued compliance with vendor support and security updates. The cumulative effect of these safeguards is a dramatically reduced attack surface and improved auditability across systems. Control 2 therefore acts as the enterprise’s internal gatekeeper—ensuring that every executable action, from desktop utilities to backend applications, is both intentional and defensible against misuse or compromise.
 Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.