Software Installation Function

Modifying the allowlist to admit adversary software is defeated where installation requires an explicit identified privilege, which is what the practice mandates for flight and ground configuration alike. [Curation] Requiring an explicit identified privilege to INSTALL software does not govern editing the allowlist itself, which is a policy object rather than an installation. The practice is adjacent to the technique and constrains what the modified allowlist can then admit, which is governance rather than interdiction.