NIST 800-171 - Least Privilege (3.1.5)

Overview:
Employ the principle of least privilege, including for specific security functions and privileged accounts.

Action Items:
3.1.5[a]
Determine if: privileged accounts are identified.

3.1.5[b]
Determine if: access to privileged accounts is authorized in accordance with the principle of least privilege.

3.1.5[c]
Determine if: security functions are identified.

3.1.5[d]
Determine if: access to security functions is authorized in accordance with the principle of least privilege.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1
Examine: Access control policy; procedures addressing account management; system security plan; system design documentation; system configuration settings and associated documentation; list of active system accounts and the name of the individual associated with each account; list of conditions for group and role membership; notifications or records of recently transferred, separated, or terminated employees; list of recently disabled system accounts along with the name of the individual associated with each account; access authorization records; account management compliance reviews; system monitoring/audit records; procedures addressing least privilege; list of security functions (deployed in hardware, software, and firmware) and security-relevant information for which access is to be explicitly authorized; list of system-generated privileged accounts; list of system administration personnel; other relevant documents or records].

2
Interview: Personnel with account management responsibilities; system or network administrators; personnel with information security responsibilities; personnel with responsibilities for defining least privileges necessary to accomplish specified tasks].

3
Test: Organizational processes for managing system accounts; mechanisms for implementing account management; mechanisms implementing least privilege functions; mechanisms prohibiting privileged access to the system].

Related Documents (document name and content will vary by organization):
1) Access control policy
2) procedures addressing account management
3) system security plan
4) system design documentation
5) system configuration settings and associated documentation
6) list of active system accounts and the name of the individual associated with each account
7) list of conditions for group and role membership
8) notifications or records of recently transferred, separated, or terminated employees
9) list of recently disabled system accounts along with the name of the individual associated with each account
10) access authorization records
11) account management compliance reviews
12) system monitoring/audit records
13) procedures addressing least privilege
14) list of security functions (deployed in hardware, software, and firmware) and security-relevant information for which access is to be explicitly authorized
15) list of system-generated privileged accounts
16) list of system administration personnel
17) other relevant documents or records

Additional Guidance:
Organizations employ the principle of least privilege for specific duties and authorized accesses for users and processes. The principle of least privilege is applied with the goal of authorized privileges no higher than necessary to accomplish required organizational missions or business functions. Organizations consider the creation of additional processes, roles, and system accounts as necessary, to achieve least privilege. Organizations also apply least privilege to the development, implementation, and operation of organizational systems. Security functions include, for example, establishing system accounts, setting events to be logged, setting intrusion detection parameters, and configuring access authorizations (i.e., permissions, privileges).

Privileged accounts, including super user accounts, are typically described as system administrator for various types of commercial off-the-shelf operating systems. Restricting privileged accounts to specific personnel or roles prevents day-to-day users from having access to privileged information or functions. Organizations may differentiate in the application of this requirement between allowed privileges for local accounts and for domain accounts provided organizations retain the ability to control system configurations for key security parameters and as otherwise necessary to sufficiently mitigate risk.