1. A method of allowing authorized code to execute on a computer system, the method comprising: intercepting, by a kernel-level driver within the computer system, a request to create a process associated with a code module; determining, by the kernel-level driver, if the request is authorized by authenticating the request with reference to a multi-level whitelist database architecture, the multi-level whitelist database architecture including (i) a global whitelist database hosted by a trusted third party service provider (ii) a local whitelist database created based on the global whitelist and (iii) an in-memory code module cache containing entries corresponding to code modules that have previously been authenticated with reference to the global whitelist database or the local whitelist database, the entries including information regarding whether the corresponding code module has been altered since it was previously authenticated and information regarding whether the corresponding code module was previously affirmatively authenticated; allowing, by the kernel-level driver, the code module to be loaded and executed by granting the request if the request is authorized.