NIST 800-171 - Audit of Privileged Use (3.1.7)

Overview:
Prevent non-privileged users from executing privileged functions and audit the execution of such functions.

Action Items:
3.1.7[a]
Determine if: privileged functions are defined.

3.1.7[b]
Determine if: non-privileged users are defined.

3.1.7[c]
Determine if: non-privileged users are prevented from executing privileged functions.

3.1.7[d]
Determine if: the execution of privileged functions is captured in audit logs.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1
Examine: Access control policy; procedures addressing least privilege; system security plan; system design documentation; list of privileged functions and associated user account assignments; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records].

2
Interview: Personnel with responsibilities for defining least privileges necessary to accomplish specified tasks; personnel with information security responsibilities; system developers].

3
Test: Mechanisms implementing least privilege functions for non-privileged users; mechanisms auditing the execution of privileged functions].

Related Documents (document name and content will vary by organization):
1) Access control policy
2) procedures addressing least privilege
3) system security plan
4) system design documentation
5) list of privileged functions and associated user account assignments
6) system configuration settings and associated documentation
7) system audit logs and records
8) other relevant documents or records

Additional Guidance:
Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Logging the use of privileged functions is one way to detect such misuse, and in doing so, help mitigate the risk from insider threats and the advanced persistent threat.

Privileged functions include, for example, establishing system accounts, performing system integrity checks, conducting patching operations, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and intrusion prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. Note that this requirement represents a condition to be achieved by the definition of authorized privileges in 3.1.2