Create and use blacklists, whitelists and greylists
Create lists to quickly compare information to automate or require further actions. For example:
- A blacklist automatically blocks anything included on the list.
- A whitelist automatically blocks anything not included on the list. This is the opposite of a blacklist.
- A greylisting temporary blocks or places limits on anything included on the list until an additional step is performed, such as a manual check.
Why this countermeasure matters
Not using blacklists, whitelists or greylists can lead to:
- fraudsters operating across different government programs without detection
- fraudsters moving from one government program to another without detection
- fraudsters reusing methods such as compromised identities to access accounts
- fraudsters using the same bank account to hijack multiple payments.
How to put this countermeasure in place
Some ways to implement this countermeasure include:
- blacklisting suspect bank accounts so they cannot be used for a client, provider or vendor
- making greylisted providers go through additional suitability checks before being registered
- requiring someone to choose from only an approved list of providers or vendors (white listing).
How to measure this countermeasure's effectiveness
Measure the effectiveness of this countermeasure by using the following methods:
- Conduct pressure testing to confirm that the list works as intended.
- Consult subject matter experts about the lists.
- Review policies or other documentation related to the lists.
- Conduct a process walk through to observe how the lists work.
- Review reports to see how many blocks are reported and how often.
- Confirm the lists are 'always on' and automatically applied.
- Confirm that the systems/processes underlying the lists are adequate and reliable.
- Confirm that attempts to use blacklisted information is flagged and reviewed.
- Confirm that blacklisted information is not widely known or accessible.
- Confirm that someone cannot manipulate the lists even when pressure or coercion is applied.
- Confirm that access to the lists is monitored and reviewed.
- Confirm that the lists are kept up-to-date.
This type of countermeasure is supported by: