CMMC Practice AC.L2-3.1.7 – Privileged Functions: Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
Links to Publicly Available Resources
This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2. This article from Federal News Network provides an overview of key controls that are essential to NIST SP 800-171 compliance: access controls, awareness and training, audit and accountability, configuration management, and identification and authentication. This article demonstrates a PAM capability that effectively protects, monitors, NIST resource that defines the requirements for the principle of least privilege This article provides an in-depth overview of how to audit, detect and defend against specific privilege abuse actions in Windows. In this edition of the On Call Compliance Solutions Compliance Tip of the Week, we discuss how certain requirements limit exposure when operating from within privileged accounts or roles.
and manages privileged account access to include their life cycle management, authentication, authorization, auditing, and access controls.
Discussion [NIST SP 800-171 R2]
Privileged functions include establishing system accounts, performing system integrity checks, conducting patching operations, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. Note that this requirement represents a condition to be achieved by the definition of authorized privileges in 3.1.2 (AC.L1-3.1.2).
Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Logging the use of privileged functions is one way to detect such misuse, and in doing so, help mitigate the risk from insider threats and the advanced persistent threat.
Further Discussion
Non-privileged users should receive only those permissions required to perform their basic job functions. Privileged users are granted additional permissions because their jobs require them. Privileged functions typically involve the control, monitoring, or administration of the system and its security measures. When these special privileged functions are performed, the activity must be captured in an audit log, which can be used to identify abuse. Non privileged employees must not be granted permission to perform any of the functions of a privileged user.
This practice, AC.L2-3.1.7, manages non-privileged users by logging any attempts to execute privileged functions. AC.L2-3.1.7 leverages AU.L2-3.3.2, which ensures logging and traceability of user actions. AC.L2-3.1.7 also extends AC.L1-3.1.2, which defines a requirement to limit types of transactions and functions to those that authorized users are permitted to execute.