1. A method comprising: monitoring, by a kernel mode driver of a computer system, a set of events occurring within one or more of a file system accessible by the computer system and an operating system that manages resources of the computer system; responsive to initiation of an event of the set of events by an active process running on the computer system, wherein the active process corresponds to a first code module stored within the file system and the event relates to a second code module stored within the file system, the kernel mode driver, determining an identity or type of the first code module; based on the determined identity or type of the first code module, the kernel mode driver, selectively performing or bypassing a real-time authentication process on the second code module with reference to a multi-level whitelist, wherein the multi-level whitelist includes (i) a global whitelist database remote from the computer system and maintained by a trusted service provider, the global whitelist database containing cryptographic hash values of approved code modules, which are known not to contain viruses or malicious code and (ii) a local whitelist database containing cryptographic hash values of at least a subset of the approved code modules; and allowing the active process to load the second code module into a memory of the computer system (i) when the real-time authentication process is bypassed or (ii) when the real-time authentication process is performed and determines a cryptographic hash value of the code module matches one of the cryptographic hash values of approved code modules within the multi-level whitelist.