Overview:
Use non-privileged accounts or roles when accessing non-security functions.
Action Items:
3.1.6[a]
Determine if: nonsecurity functions are identified.
3.1.6[b]
Determine if: users are required to use non-privileged accounts or roles when accessing nonsecurity functions.
POTENTIAL ASSESSMENT METHODS AND OBJECTS
1
Examine: Access control policy; procedures addressing least privilege; system security plan; list of system-generated security functions assigned to system accounts or roles; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records].
2
Interview: Personnel with responsibilities for defining least privileges necessary to accomplish specified organizational tasks; personnel with information security responsibilities; system or network administrators].
3
Test: Mechanisms implementing least privilege functions].
Related Documents (document name and content will vary by organization):
1) Access control policy
2) procedures addressing least privilege
3) system security plan
4) list of system-generated security functions assigned to system accounts or roles
5) system configuration settings and associated documentation
6) system audit logs and records
7) other relevant documents or records
Additional Guidance:
Organizations employ the principle of least privilege for specific duties and authorized accesses for users and processes. The principle of least privilege is applied with the goal of authorized privileges no higher than necessary to accomplish required organizational missions or business functions. Organizations consider the creation of additional processes, roles, and system accounts as necessary, to achieve least privilege. Organizations also apply least privilege to the development, implementation, and operation of organizational systems. Security functions include, for example, establishing system accounts, setting events to be logged, setting intrusion detection parameters, and configuring access authorizations (i.e., permissions, privileges).
Privileged accounts, including super user accounts, are typically described as system administrator for various types of commercial off-the-shelf operating systems. Restricting privileged accounts to specific personnel or roles prevents day-to-day users from having access to privileged information or functions. Organizations may differentiate in the application of this requirement between allowed privileges for local accounts and for domain accounts provided organizations retain the ability to control system configurations for key security parameters and as otherwise necessary to sufficiently mitigate risk.
Article ID: 111
Created: September 26, 2022
Last Updated: September 27, 2022
Author: Matthew Burdick
Online URL: http://www.compliancewiki.org/article/nist-800-171-non-privileged-account-use-3-1-6-111.html