application-level authorized software
A layer-scoped enforcement boundary within an authorized-software (allowlisting) control regime, specifically the granularity at which permitted-execution policy is applied to discrete, named software applications as whole units. It distinguishes coarse-grained controls that identify and permit or deny execution at the application boundary from finer-grained controls operating below that boundary — at the levels of APIs, modules, scripts, system processes, kernel functions, drivers, and dynamic-link libraries. The field uses it as a reference point for characterizing the *depth* of an allowlisting implementation: controls that act only at this layer can be bypassed by malicious code embedded within or loaded by an already-authorized application, which is why standards guidance calls for decomposing and monitoring software at sub-application levels to close that gap.
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in NIST SP 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A layer-scoped enforcement boundary within an authorized-software (allowlisting) control regime, specifically the granularity at which permitted-execution policy is applied to discrete, named software applications as whole units. It distinguishes coarse-grained controls that identify and permit or deny execution at the application boundary from finer-grained controls operating below that boundary — at the levels of APIs, modules, scripts, system processes, kernel functions, drivers, and dynamic-link libraries. The field uses it as a reference point for characterizing the *depth* of an allowlisting implementation: controls that act only at this layer can be bypassed by malicious code embedded within or loaded by an already-authorized application, which is why standards guidance calls for decomposing and monitoring software at sub-application levels to close that gap.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.