Allowlist Authorized Libraries
Description
Use technical controls to ensure that only authorized software libraries, such as specific .dll, .ocx, .so, etc., files, are allowed to load into a system process. Block unauthorized libraries from loading into a system process. Reassess bi-annually, or more frequently.
Implementation Checklist
Tool Recommendations
Unified endpoint management platform for device enrollment, software deployment, configuration, and compliance across Windows, macOS, iOS, and Android
Microsoft · Per-user/per-device subscription
Digital workspace platform combining UEM with virtual app delivery and zero-trust access for endpoint management
Broadcom (VMware) · Per-device subscription
IT asset management and software asset management platform with license optimization and SaaS management
Flexera · Enterprise subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
DLL Hijacking and Side-Loading Attacks
IntegrityAttackers place malicious DLLs in application directories or system paths to be loaded by legitimate processes, achieving code execution within trusted process contexts.
Supply Chain Library Poisoning
ConfidentialityCompromised shared libraries from third-party vendors or open-source repositories are loaded into system processes, providing attackers with code execution through trusted channels.
Vulnerabilities (When Safeguard Absent)
No Restriction on Library Loading
Without library allowlisting, any DLL, SO, or OCX file can be loaded into a system process, allowing attackers to inject malicious code through library manipulation.
Unvalidated Shared Library Integrity
The absence of controls verifying library authenticity before loading means modified or replaced libraries execute with the same privileges as the host process.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |