General considerations when selecting allowlisting software

Consider the following factors when selecting allowlisting software to be used with AVEVA Enterprise SCADA:

• It should run on the operating systems (OSs) targeted for your deployment. This includes both client and server versions of Windows, and potentially Windows Server Core.

• It should support Authenticode signed binaries.

• It should support being deployed and managed in on-premises infrastructures without Internet connectivity.

• It should support evaluating dynamically generated binaries.

• It should support centralized management (that is, the configuration and maintenance of Application Control policies from a central management point).

• It should support the import and export of rules or policies.

• It should be evaluated in a test environment before any deployment to a production system (both initial validation, updates, and any ongoing maintenance).

• It should be capable of operating in a monitoring mode that reports policy violations and exceptions but does not block application execution.

• It should scan all processes, regardless if they are started by an interactive user or a system service.

• It should support targeted rules based on such things as users or user groups and machines.

• It should be capable of controlling executable files, scripts, Microsoft Installer (MSI) files, and Dynamic-link library (DLL) files.

• It should be capable of defining rules based on file digital signature and cryptographic hashes for files that are not digitally signed.

• It should be capable of handling possible failure modes and providing fallback strategies in the event of allowlisting subsystem issues.