Device Class 3: Least Privilege

Control ID: AC-6 Least Privilege Family: Access Control Source: NIST 800-53r4
Control: The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
Supplemental Guidance:
Organizations employ least privilege for specific duties and information systems. The principle of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions/business functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary, to achieve least privilege. Organizations also apply least privilege to the development, implementation, and operation of organizational information systems.

Related Controls: AC-2, AC-3, AC-5, CM-6, CM-7, PL-2
Control Enhancements:
(3) Least Privilege | Network Access To Privileged Commands
The organization authorizes network access to [Assignment: organization-defined privileged commands] only for [Assignment: organization-defined compelling operational needs] and documents the rationale for such access in the security plan for the information system.
Supplemental Guidance: Network access is any access across a network connection in lieu of local access (i.e.,user being physically present at the device).
Related Controls: AC-17

(9) Least Privilege | Auditing Use Of Privileged Functions
The information system audits the execution of privileged functions.
Supplemental Guidance: Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse, and in doing so, help mitigate the risk from insider threats and the advanced persistent threat (APT).
Related Controls: N/A

(10) Least Privilege | Prohibit Non-privileged Users From Executing Privileged Functions
The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
Supplemental Guidance: Privileged functions include, for example, establishing information system accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations.
Related Controls: N/A
References: N/A
Mechanisms:

No specific mechanisms given: see AC-3.

  • A user shall not be permitted more permission to resources via network access then as if they were physically present at the device .
  • Where possible additional controls should be in place to only allow limited network functionality for a remote user. This way if the account is compromised the amount of damage caused by an attacker with network access is diminished.
Protocol Implementation Conformance Statements: N/A