A method for providing security on a controller , the method comprising: launching, by the controller , a kernel-level security layer that includes a whitelist of permitted processes on the controller, the whitelist being part of a custom security policy for the controller, wherein one or more hooks are registered for one or more kernel level processes on the controller , the hooks configured to cause calls to the one or more kernel level processes to be redirected to the security layer with (i) process information identifying a kernel level process being called and (ii) a pointer to the called process in memory ; receiving, at the security level of the controller , a request to run a particular process; redirecting the request to run the particular process in the security layer using a corresponding hook function of the one or more registered hooks; determining, by the hook function of the security layer , using a pointer of the particular process in the memory , a signature for a current state of the particular process; identifying, by the hook function of the security layer , a verified signature for the particular process from the whitelist using particular process information identifying the particular process; determining, by the hook function of the security layer , whether the current state of the particular process is permitted to be run on the controller based on a comparison of the determined signature with the verified signature from the whitelist ; and blocking, by the security layer , the particular process from running on the controller based on the determined signature not matching the verified signature for the process. launching, by the controller , a kernel-level security layer that includes a whitelist of permitted processes on the controller, the whitelist being part of a custom security policy for the controller, wherein one or more hooks are registered for one or more kernel level processes on the controller , the hooks configured to cause calls to the one or more kernel level processes to be redirected to the security layer with (i) process information identifying a kernel level process being called and (ii) a pointer to the called process in memory ; receiving, at the security level of the controller , a request to run a particular process; redirecting the request to run the particular process in the security layer using a corresponding hook function of the one or more registered hooks; determining, by the hook function of the security layer , using a pointer of the particular process in the memory , a signature for a current state of the particular process; identifying, by the hook function of the security layer , a verified signature for the particular process from the whitelist using particular process information identifying the particular process; determining, by the hook function of the security layer , whether the current state of the particular process is permitted to be run on the controller based on a comparison of the determined signature with the verified signature from the whitelist ; and blocking, by the security layer , the particular process from running on the controller based on the determined signature not matching the verified signature for the process. <EOS>