Assessment Objective
Determine if:
- system access for users (or processes acting on behalf of users) is authorized only when necessary to accomplish assigned organizational tasks.
- access to [Assignment: security functions] is authorized.
- access to [Assignment: security-relevant information] is authorized.
- the privileges assigned to roles or classes of users are reviewed [Assignment: frequency] to validate the need for such privileges.
- privileges are reassigned or removed, as necessary.
Assessment Methods
Examine
- access control policy and procedures
- procedures for least privilege
- list of assigned access authorizations (i.e., privileges)
- system configuration settings
- system audit records
- list of security functions (implemented in hardware, software, and firmware)
- security-relevant information for which access must be explicitly authorized
- list of system-generated roles or classes of users and assigned privileges
- validation reviews of privileges assigned to roles or classes of users
- records of privilege removals or reassignments for roles or classes of users
- system security plan
- system design documentation
- other relevant documents or records
Interview
- personnel with responsibilities for defining least privileges
- personnel with information security responsibilities
- system administrators
Test
- mechanisms for implementing least privilege functions
- mechanisms for implementing reviews of user privileges
Pedidos ligados
| Tipo de ligação | Pedido |
|---|---|
| blocks | 03.01.05 Least Privilege |