Use of privileged utility programs

What the requirement asks

Utility programs able to override system and application controls are to have their use limited and tightly controlled. Purpose: prevent utility programs from undermining system and application security controls. Guidance: consider limiting such utilities to the smallest practical number of trusted, authorized users (8.2); applying identification, authentication and authorization to their use, including uniquely identifying each person using them; defining and documenting authorization levels for them; requiring authorization for one-off use; withholding them from application users on systems that depend on separated duties; removing or disabling all unneeded utilities; separating utilities logically from application software at a minimum, and where practical keeping their network traffic apart from application traffic; making them available only for limited periods, such as the duration of an authorized change; and logging every use. Other information: most systems include utilities that can bypass controls, such as diagnostic, patching, anti-virus, defragmentation, debugging, backup and network tools. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Privileged utilities can bypass controls. The guidance asks for the inventory, the authorisation, the logging and the review.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep an inventory of utility programs capable of overriding controls on each platform, with those not needed removed or disabled and one live sample together.

Evidence an assessor asks for

• Utility program controlAn inventory of utility programs capable of overriding controls on each platform, with those not needed removed or disabled
• Utility program controlA list of authorized users and documented authorization levels for each utility
• Utility program controlApprovals for ad hoc use and time-limited availability, for example tied to change tickets
• Utility program controlLogs of all utility program use with unique user identification
• Utility program controlConfiguration showing utilities segregated from application software and not accessible to users bound by segregation of duties

The question an assessor will ask

An assessor will ask for an inventory of utility programs capable of overriding controls on each platform, with those not needed removed or disabled, then trace it to the system it protects. For A.8.18 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Debuggers and database tools remain installed on production servers
• Utility use is not logged or not attributable to individuals
• Business users with segregation of duties constraints can run administrative tools
• Utilities are permanently available instead of enabled only for approved changes

Before the next audit

Before the next audit, check one live sample for this gap: debuggers and database tools remain installed on production servers.