KSI-IAM-ELP Ensuring Least Privilege

Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need.

NIST SP 800-53 Rev. 5 controls: AC-12, AC-14, AC-17, AC-17(1), AC-17(2), AC-17(3), AC-18(4), AC-2(11), AC-2(5), AC-2(6), AC-2(7), AC-2(9), AC-20, AC-20(1), AC-21, AC-3, AC-4, AC-6, AC-6(3), AC-6(8), AU-12(3), AU-6(7), CM-2(7), CM-5(1), CM-5(5), CM-7(2), CM-9, IA-11, IA-2, IA-3, IA-4, IA-4(4), IA-5(2), IA-5(6), IR-4(6), IR-9(4), PS-2, PS-3, PS-4, PS-5, PS-6, RA-5(5), SC-2, SC-20, SC-21, SC-22, SC-23, SC-3, SC-39, SC-4, SI-3, SI-4(19)

Defined terms: Persistently

1. Przegląd

1.1 Odwołania

• AC-12 Session Termination
• AC-14 Permitted Actions Without Identification or Authentication
• AC-17 Remote Access
• AC-17(01) Monitoring and Control
• AC-17(02) Protection of Confidentiality and Integrity Using Encryption
• AC-17(03) Managed Access Control Points
• AC-18(04) Restrict Configurations by Users
• AC-02(11) Usage Conditions
• AC-02(05) Inactivity Logout
• AC-02(06) Dynamic Privilege Management
• AC-02(07) Privileged User Accounts
• AC-02(09) Restrictions on Use of Shared and Group Accounts
• AC-20 Use of External Systems
• AC-20(01) Limits on Authorized Use
• AC-21 Information Sharing
• AC-03 Access Enforcement
• AC-04 Information Flow Enforcement
• AC-06 Least Privilege
• AC-06(03) Network Access to Privileged Commands
• AC-06(08) Privilege Levels for Code Execution
• AU-12(03) Changes by Authorized Individuals
• AU-06(07) Permitted Actions
• CM-02(07) Configure Systems and Components for High-risk Areas
• CM-05(01) Automated Access Enforcement and Audit Records
• CM-05(05) Privilege Limitation for Production and Operation
• CM-07(02) Prevent Program Execution
• CM-09 Configuration Management Plan
• IA-11 Re-authentication
• IA-02 Identification and Authentication (Organizational Users)
• IA-03 Device Identification and Authentication
• IA-04 Identifier Management
• IA-04(04) Identify User Status
• IA-05(02) Public Key-based Authentication
• IA-05(06) Protection of Authenticators
• IR-04(06) Insider Threats
• IR-09(04) Exposure to Unauthorized Personnel
• PS-02 Position Risk Designation
• PS-03 Personnel Screening
• PS-04 Personnel Termination
• PS-05 Personnel Transfer
• PS-06 Access Agreements
• RA-05(05) Privileged Access
• SC-02 Separation of System and User Functionality
• SC-20 Secure Name/Address Resolution Service (Authoritative Source)
• SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
• SC-22 Architecture and Provisioning for Name/Address Resolution Service
• SC-23 Session Authenticity
• SC-03 Security Function Isolation
• SC-39 Process Isolation
• SC-04 Information in Shared System Resources
• SI-03 Malicious Code Protection
• SI-04(19) Risk for Individuals
• FRD-PER Persistently

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.