ASD ISM 1471 Utilise publisher and product names in app control
What it says
When implementing application control using publisher certificate rules, publisher names and product names are used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse known publisher and product names to control which applications can run on a system.
This control is about letting only safe applications run on computers by checking who created the app and what it's called. It's important because if you don't manage which apps can run, you might accidentally allow harmful software that can steal information or break systems.
Free. Save your status, tasks and notes.
Why it matters
If publisher certificate rules don't use publisher and product names, attackers can run malicious binaries under broad publisher rules, bypassing app control and enabling compromise.
How to implement
IT team should identify trusted applications: Compile a list of software needed for business operations along with their publisher and product names.
This involves checking current software inventories and discussions with department heads to ensure all necessary applications are included.
IT manager should update policies: Develop or update existing application control policies to include rules based on publisher and product names.
Outline steps for regularly updating these policies to reflect any changes in required applications, publisher updates, or associated risks.
Procurement team should liaise with vendors: Ensure that any new software purchases are compatible with application control policies by verifying publishers and product names before buying.
This can be done through direct discussions with vendors or by consulting vendor documentation.
System administrators should configure application control settings: Use the operating system's security features to set rules allowing only approved publishers and product names.
This includes regularly reviewing these settings to make sure they are up-to-date with the latest policies.
Staff training should be conducted by HR: Organise training sessions for staff to help them recognise safe applications, explaining how to request new software installations if needed.
Use simple language and real-world examples to ensure understanding and compliance.
Keep it running
When creating publisher certificate rules, confirm both publisher and product name values from signed binaries and routinely review/update them so overly broad publisher rules don't allow unwanted apps.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The application control policy document: Request to see the formal policy that dictates how applications are approved based on publisher and product names.
Look at
The list of approved applications and compare with known safe software publishers.
Good evidence
Includes a dated policy document with detailed guidelines on allowed publishers.
- Check 2 of 5What an auditor asks for
Ask for
A software inventory report: Request an inventory that lists all applications currently installed on the system.
Look at
Compliance with the approved list of publishers and product names.
Good evidence
Is a regularly updated report with no mismatched entries.
- Check 3 of 5What an auditor asks for
Ask for
A record of system configuration settings: Examine the settings that enforce application control rules on systems.
Look at
Consistency with the application control policy.
Good evidence
Would show the settings correctly block unapproved applications based on the policy.
- Check 4 of 5What an auditor asks for
Ask for
Vendor communication records: Request emails or meeting notes regarding software procurement and check for discussions about publisher/product name verification.
Look at
Evidence of due diligence in verifying software legitimacy.
Good evidence
Includes comprehensive records of these checks.
- Check 5 of 5What an auditor asks for
Ask for
Training records: Request documentation proving that staff have received training on the application control policy. Review attendance sheets and training materials.
Good evidence
Includes clear evidence of regular training sessions and feedback forms from participants.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML1.3, Ensure only approved applications and scripts can run, which this control depends on.
ASD Essential Eight: 1 mapping
This control depends on E8-AC-ML1.3.
ISM-1471 requires that when implementing application control using publisher certificate rules, organisations use publisher names and product names to define what is allowed to run. This supports E8-AC-ML1.3 by providing a practical, scalable rule-construction method for restricting executables, libraries, scripts and other code types to an organisation-approved set. E8-AC-ML1.3 sets the overarching execution restriction outcome, while ISM-1471 is a specific technique for expressing and maintaining those allow/deny decisions.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.