[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-167":3},{"item":4,"lessons":16,"controls":22,"related":35},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-167","SP 800-167","SP 800-167: Guide to Application Whitelisting",1,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidance on application whitelisting, now usually called application allowlisting or application control. It explains how to allow only approved software to run, the attributes that can identify approved applications and how to plan and deploy the technology.\n\n**In practice.** Applying it well means starting with high-value or stable systems such as servers, defining approval rules based on publisher signatures, paths or hashes, testing in audit mode and then enforcing. A process handles requests for new software and updates. Evidence includes allowlisting policies, deployment coverage and exception records.\n\n**Common gaps.** Common gaps are rules so broad they allow most software, deployment stuck in audit mode and no process for routine updates that break rules. Allowlisting is also sometimes judged only on desktops, although it can be most effective on servers.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"malicious-browser-extension-harvests-oauth-tokens-from-31000-twitch-users","Malicious Browser Extension Harvests OAuth Tokens from 31,000 Twitch Users","2026-09-14T10:21:42.189+00:00",[23,27,31],{"slug":24,"name":25,"problem":26,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":28,"name":29,"problem":30,"stories":9},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":32,"name":33,"problem":34,"stories":9},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[36,41,45,49,54,58,63,67],{"family":37,"item":38,"code":39,"title":40,"together":9},"cis","13","Control 13","Network Monitoring and Defense",{"family":37,"item":42,"code":43,"title":44,"together":9},"2","Control 2","Inventory and Control of Software Assets",{"family":37,"item":46,"code":47,"title":48,"together":9},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":50,"item":51,"code":52,"title":53,"together":9},"gdpr","32","Article 32","Security of processing",{"family":55,"item":56,"code":57,"title":57,"together":9},"itil","overview","ITIL",{"family":59,"item":60,"code":61,"title":62,"together":9},"nist-800-53","ac-2","AC-2","Account Management",{"family":59,"item":64,"code":65,"title":66,"together":9},"sa-12","SA-12","Supply Chain Protection",{"family":59,"item":68,"code":69,"title":70,"together":9},"si-3","SI-3","Malicious Code Protection"]