Least Privilege

Intent of this Standard

To minimise the time to detect breaches and compromises, organisations need to be able to proactively monitor for any anomalous or unintended changes or activity within their environment. Early detection will assist in limiting the impact of any breach or compromise and enables organisations to activate steps that facilitate their containment and incident response processes.

For this to be successful, an understanding of the baseline operating environment and behaviour will aid in the early detection and identification of unusual or unexpected behaviour. Establishing and maintaining a baseline for an operating environment, in conjunction with regular reviews, will effectively reduce false-positive detection rates.

The area of anomalous behaviour detection is broad, and this Standard seeks to provide guidance on initial deployments. This Standard addresses the areas of successful and unsuccessful user authentication, privilege escalation, and infrastructure utilisation.

Minimum capability maturity level

We have established criteria within a maturity model to provide clarity, including the expected minimum implementation level, which is CS-CMM 2.

Cyber Security Capability Maturity Model

The requirements are intended to meet and comply with each respective level of maturity. The levels provide a pathway that can be used by agencies to assess themselves against, with a view to improving maturity over time.

Each maturity level builds on the requirement from the preceding level.

Below are the requirements for each capability maturity level for this Standard.

Focus areas

Focus areas are applicable to the standard and are provided as a guide and not an exhaustive list. Each agency is best placed to identify areas of relevance.

The focus areas for this Standard are:

• Corporate network

• Cloud services

• Software as a service

• Bring-your-own-device access

• Internal systems

• Domain Naming System (DNS).

Suggested actions

The following list is not exhaustive. Organisations should identify which actions are appropriate to implement the Standard based on their current maturity level. However, the following actions follow good practice guidelines:

• Separate user credentials are allocated for standard-user and privileged-user accounts.
• A formal process of review and approval for granting privileged user access.
• Systems or applications where least privilege is to be applied are identified and approved.
• Roles and user groups are defined with permissions relevant to that role.
• Accounts are allocated into roles and user groups.
• Time and location-based restrictions are applied as appropriate for the role or system.
• System-hardening processes include changing all default passwords and disabling default accounts and services not being used.
• Regular audits are undertaken for usage, privileged users, and change to an account’s password and permissions.
• Just-in-time (JIT) access control is implemented.
• Role-based access control (RBAC) is used to best reflect an individual user’s privileges.
• Logging for privileged user access is monitored and stored in a central location.
• Ensure third parties are aware of and comply with an organisation's requirements around least privilege.

Key dependencies

To implement this Standard, there are likely to be requisite measures or technologies in place.

A number of dependencies apply to multiple standards. In general, these dependencies are less technology-specific and relate to business processes.

Key dependencies for this Standard include:

• User permissions for roles have been defined.
• All systems have been identified.
• Privileged user lists are accurate and current to enable account permission settings and align individual users to accounts.
• Logging functionality is available.
• Management support and expectations around user access.
• Policies set out expectations for what the default access level should be.

Measurable outcomes

To establish whether the Standard is being implemented, the outcomes are a tool an organisation may wish (or already have in place) to measure to help make this determination.

The outcomes have been designed to align with the requirements contained in the maturity level.

Outcomes for this Standard include:

• Privileged user roles are defined based on the organisation's role settings.
• A management or directive exists that sets out expectations for least privilege as a default.
• An account register is maintained.
• Evidence of privileged user audits.
• All accounts have permissions relevant to their roles.
• Regular review of assigned users and account privileges.
• Least-privilege user permissions for roles are documented and reviewed on a regular basis.
• Evidence of review and monitoring of privileged user activity.
• Just-in-time (JIT) access is used to temporarily grant and revoke access.