+AC-06 Least Privilege
---+AC-06(01) Authorize Access to Security Functions
---+AC-06(02) Non-privileged Access for Nonsecurity Functions
---+AC-06(03) Network Access to Privileged Commands
---+AC-06(04) Separate Processing Domains
---+AC-06(05) Privileged Accounts
---+AC-06(06) Privileged Access by Non-organizational Users
---+AC-06(07) Review of User Privileges
---+AC-06(08) Privilege Levels for Code Execution
---+AC-06(09) Log Use of Privileged Functions
---+AC-06(10) Prohibit Non-privileged Users from Executing Privileged Functions
|
AC-06 Least Privilege
Control
Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
Discussion
Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems.
Assessment Objective
the principle of least privilege is employed, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
Assessment Method
Examine
Access control policy
procedures addressing least privilege
list of assigned access authorizations (user privileges)
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
organizational personnel with information security responsibilities
system/network administrators
1. Panoramica
| Titolo |
Standard |
|
AC-06(01) Authorize Access to Security Functions
|
Control
Authorize access for [Assignement: individuals and roles] to:- [Assignement: organization-defined security functions (deployed in hardware, software, and firmware)] ; and
- [Assignement: security-relevant information].
Discussion
Security functions include establishing system accounts, configuring access authorizations (i.e., permissions, privileges), configuring settings for events to be audited, and establishing intrusion detection parameters. Security-relevant information includes filtering rules for routers or firewalls, configuration parameters for security services, cryptographic key management information, and access control lists. Authorized personnel include security administrators, system administrators, system security officers, system programmers, and other privileged users.
Assessment Objective
- access is authorized for [Assignement: individuals and roles] to [Assignement: security functions (deployed in hardware)];
- access is authorized for [Assignement: individuals and roles] to [Assignement: security functions (deployed in software)];
- access is authorized for [Assignement: individuals and roles] to [Assignement: security functions (deployed in firmware)];
- access is authorized for [Assignement: individuals and roles] to [Assignement: security-relevant information].
Assessment Method
Examine
Access control policy
procedures addressing least privilege
list of security functions (deployed in hardware, software, and firmware) and security-relevant information for which access must be explicitly authorized
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
organizational personnel with information security responsibilities
system/network administrators
|
|
AC-06(02) Non-privileged Access for Nonsecurity Functions
|
Control
Require that users of system accounts (or roles) with access to [Assignement: security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions.
Discussion
Requiring the use of non-privileged accounts when accessing nonsecurity functions limits exposure when operating from within privileged accounts or roles. The inclusion of roles addresses situations where organizations implement access control policies, such as role-based access control, and where a change of role provides the same degree of assurance in the change of access authorizations for the user and the processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account.
Assessment Objective
users of system accounts (or roles) with access to [Assignement: security functions or security-relevant information] are required to use non-privileged accounts or roles when accessing non-security functions.
Assessment Method
Examine
Access control policy
procedures addressing least privilege
list of system-generated security functions or security-relevant information assigned to system accounts or roles
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
organizational personnel with information security responsibilities
system/network administrators
|
|
AC-06(03) Network Access to Privileged Commands
|
Control
Authorize network access to [Assignement: privileged commands] only for [Assignement: compelling operational needs] and document the rationale for such access in the security plan for the system.
Discussion
Network access is any access across a network connection in lieu of local access (i.e., user being physically present at the device).
Assessment Objective
- network access to [Assignement: privileged commands] is authorized only for [Assignement: compelling operational needs];
- the rationale for authorizing network access to privileged commands is documented in the security plan for the system.
Assessment Method
Examine
Access control policy
procedures addressing least privilege
system configuration settings and associated documentation
system audit records
list of operational needs for authorizing network access to privileged commands
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
organizational personnel with information security responsibilities
|
|
AC-06(04) Separate Processing Domains
|
Control
Provide separate processing domains to enable finer-grained allocation of user privileges.
Discussion
Providing separate processing domains for finer-grained allocation of user privileges includes using virtualization techniques to permit additional user privileges within a virtual machine while restricting privileges to other virtual machines or to the underlying physical machine, implementing separate physical domains, and employing hardware or software domain separation mechanisms.
Assessment Objective
separate processing domains are provided to enable finer-grain allocation of user privileges.
Assessment Method
Examine
Access control policy
procedures addressing least privilege
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
organizational personnel with information security responsibilities
system developers
|
|
AC-06(05) Privileged Accounts
|
Control
Restrict privileged accounts on the system to [Assignement: personnel or roles].
Discussion
Privileged accounts, including super user accounts, are typically described as system administrator for various types of commercial off-the-shelf operating systems. Restricting privileged accounts to specific personnel or roles prevents day-to-day users from accessing privileged information or privileged functions. Organizations may differentiate in the application of restricting privileged accounts between allowed privileges for local accounts and for domain accounts provided that they retain the ability to control system configurations for key parameters and as otherwise necessary to sufficiently mitigate risk.
Assessment Objective
privileged accounts on the system are restricted to [Assignement: personnel or roles].
Assessment Method
Examine
Access control policy
procedures addressing least privilege
list of system-generated privileged accounts
list of system administration personnel
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
organizational personnel with information security responsibilities
system/network administrators
|
|
AC-06(06) Privileged Access by Non-organizational Users
|
Control
Prohibit privileged access to the system by non-organizational users.
Discussion
An organizational user is an employee or an individual considered by the organization to have the equivalent status of an employee. Organizational users include contractors, guest researchers, or individuals detailed from other organizations. A non-organizational user is a user who is not an organizational user. Policies and procedures for granting equivalent status of employees to individuals include a need-to-know, citizenship, and the relationship to the organization.
Assessment Objective
privileged access to the system by non-organizational users is prohibited.
Assessment Method
Examine
Access control policy
procedures addressing least privilege
list of system-generated privileged accounts
list of non-organizational users
system configuration settings and associated documentation
audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
organizational personnel with information security responsibilities
system/network administrators
|
|
AC-06(07) Review of User Privileges
|
Control
- Review [Assignement: frequency] the privileges assigned to [Assignement: roles and classes] to validate the need for such privileges; and
- Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.
Discussion
The need for certain assigned user privileges may change over time to reflect changes in organizational mission and business functions, environments of operation, technologies, or threats. A periodic review of assigned user privileges is necessary to determine if the rationale for assigning such privileges remains valid. If the need cannot be revalidated, organizations take appropriate corrective actions.
Assessment Objective
- privileges assigned to [Assignement: roles and classes] are reviewed [Assignement: frequency] to validate the need for such privileges;
- privileges are reassigned or removed, if necessary, to correctly reflect organizational mission and business needs.
Assessment Method
Examine
Access control policy
procedures addressing least privilege
list of system-generated roles or classes of users and assigned privileges
system design documentation
system configuration settings and associated documentation
validation reviews of privileges assigned to roles or classes or users
records of privilege removals or reassignments for roles or classes of users
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for reviewing least privileges necessary to accomplish specified tasks
organizational personnel with information security responsibilities
system/network administrators
|
|
AC-06(08) Privilege Levels for Code Execution
|
Control
Prevent the following software from executing at higher privilege levels than users executing the software: [Assignement: software].
Discussion
In certain situations, software applications or programs need to execute with elevated privileges to perform required functions. However, depending on the software functionality and configuration, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking such applications or programs, those users may indirectly be provided with greater privileges than assigned.
Assessment Objective
[Assignement: software] is prevented from executing at higher privilege levels than users executing the software.
Assessment Method
Examine
Access control policy
procedures addressing least privilege
list of software that should not execute at higher privilege levels than users executing software
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
AC-06(09) Log Use of Privileged Functions
|
Control
Log the execution of privileged functions.
Discussion
The misuse of privileged functions, either intentionally or unintentionally by authorized users or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Logging and analyzing the use of privileged functions is one way to detect such misuse and, in doing so, help mitigate the risk from insider threats and the advanced persistent threat.
Assessment Objective
the execution of privileged functions is logged.
Assessment Method
Examine
Access control policy
procedures addressing least privilege
system design documentation
system configuration settings and associated documentation
list of privileged functions to be audited
list of audited events
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for reviewing least privileges necessary to accomplish specified tasks
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
AC-06(10) Prohibit Non-privileged Users from Executing Privileged Functions
|
Control
Prevent non-privileged users from executing privileged functions.
Discussion
Privileged functions include disabling, circumventing, or altering implemented security or privacy controls, establishing system accounts, performing system integrity checks, and administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Privileged functions that require protection from non-privileged users include circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms. Preventing non-privileged users from executing privileged functions is enforced by [AC-3](#ac-3).
Assessment Objective
non-privileged users are prevented from executing privileged functions.
Assessment Method
Examine
Access control policy
procedures addressing least privilege
system design documentation
system configuration settings and associated documentation
list of privileged functions and associated user account assignments
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
organizational personnel with information security responsibilities
system developers
|
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
Ticket collegati
|