Assessment Objective
Determine if:
- privileged accounts on the system are restricted to [Assignment: personnel or roles].
- users (or roles) with privileged accounts are required to use non-privileged accounts when accessing non-security functions or non-security information.
Assessment Methods
Examine
- access control policy and procedures
- procedures for least privilege
- list of system-generated privileged accounts
- list of system administration personnel
- system audit records
- system configuration settings
- system security plan
- list of system-generated security functions or security-relevant information assigned to system accounts or roles
- other relevant documents or records
Interview
- personnel with responsibilities for defining least privileges
- personnel with information security responsibilities
- system administrators
Test
- mechanisms for implementing least privilege functions
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | 03.01.06 Least Privilege – Privileged Accounts |