A system comprising: an industrial controller configured for communicating with and controlling a field device (16, 18, 20) of an industrial plant via a network and configured to receive sensory data from the field device (16, 18, 20) via the network; the industrial controller comprising: a memory configured to store one or more executable files including binary instructions; and a processor; the processor being configured to; - execute a start-up executable file from received executable files to determine a private encryption key; - decrypt an encrypted whitelist file using the private encryption key; wherein the whitelist file includes a list identifying executable files that are authorized to run on the industrial controller and hash key values for each of the identified executable files; - determine that an exectuable file is attempting execution; - derive a hash key value from the executable file attempting execution; - determine if the derived hash key value is included in the decrypted whitelist; - allow the executable file attempting execution to execute when determining that the derived hash key value is included in the decrypted whitelist; - block the executable file attempting execution from executing when determining that the derived hash key value is not included in the decrypted whitelist; wherein execution of the executable file comprises execution of the binary instructions in the executable file to control the field device (16, 18, 20). an industrial controller configured for communicating with and controlling a field device (16, 18, 20) of an industrial plant via a network and configured to receive sensory data from the field device (16, 18, 20) via the network; the industrial controller comprising: a memory configured to store one or more executable files including binary instructions; and a processor; the processor being configured to; - execute a start-up executable file from received executable files to determine a private encryption key; - decrypt an encrypted whitelist file using the private encryption key; wherein the whitelist file includes a list identifying executable files that are authorized to run on the industrial controller and hash key values for each of the identified executable files; - determine that an exectuable file is attempting execution; - derive a hash key value from the executable file attempting execution; - determine if the derived hash key value is included in the decrypted whitelist; - allow the executable file attempting execution to execute when determining that the derived hash key value is included in the decrypted whitelist; - block the executable file attempting execution from executing when determining that the derived hash key value is not included in the decrypted whitelist; a memory configured to store one or more executable files including binary instructions; and a processor; the processor being configured to; - execute a start-up executable file from received executable files to determine a private encryption key; - decrypt an encrypted whitelist file using the private encryption key; wherein the whitelist file includes a list identifying executable files that are authorized to run on the industrial controller and hash key values for each of the identified executable files; - execute a start-up executable file from received executable files to determine a private encryption key; - decrypt an encrypted whitelist file using the private encryption key; - determine that an exectuable file is attempting execution; - derive a hash key value from the executable file attempting execution; - determine if the derived hash key value is included in the decrypted whitelist; - allow the executable file attempting execution to execute when determining that the derived hash key value is included in the decrypted whitelist; - block the executable file attempting execution from executing when determining that the derived hash key value is not included in the decrypted whitelist; wherein execution of the executable file comprises execution of the binary instructions in the executable file to control the field device (16, 18, 20).