1. A method comprising: intercepting, by a kernel-level driver within a kernel of an operating system of a computer system, activity in connection with a file system associated with the computer system or the operating system relating to a code module; determining, by the kernel-level driver, whether to allow the intercepted activity to proceed by performing a real-time authentication process of the code module with reference to a multi-level whitelist database architecture, wherein the multi-level whitelist database architecture includes: a local copy of a remote global whitelist database hosted by a trusted third-party service provider containing cryptographic hash values of approved code modules, which have been identified by multiple sources as not containing viruses or malicious code, wherein the local copy of the remote global whitelist database is hosted within an enterprise network with which the computer system is associated; a local whitelist database stored within the file system including a subset of the cryptographic hash values of the approved code modules; and a most recently used (MRU) cache maintained within a random access memory of the computer system and containing entries corresponding to code modules that have previously been authenticated by the real-time authentication process, the entries each including information indicative of whether the corresponding code module was previously affirmatively authenticated by the real-time authentication process; when the intercepted activity is allowed to proceed as a result of said determining, permitting, by the kernel-level driver, the code module to be loaded and executed by the computer system; and when the intercepted activity is not allowed to proceed as a result of said determining, preventing, by the kernel-level driver, the code module from being loaded and executed by the computer system.