800-53|AC-6

Title

LEAST PRIVILEGE

Description

The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

Supplemental

Organizations employ least privilege for specific duties and information systems. The principle of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions/business functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary, to achieve least privilege. Organizations also apply least privilege to the development, implementation, and operation of organizational information systems.

Reference Item Details

Related: AC-2,AC-3,AC-5,CM-6,CM-7,PL-2

Category: ACCESS CONTROL

Family: ACCESS CONTROL

Priority: P1

Baseline Impact: MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1 Create local-settings.js file - general.config.filenameUnixCIS Mozilla Firefox 38 ESR Linux L1 v1.0.0
1.1 Ensure web content is on non-system partitionWindowsCIS IIS 10 v1.1.1 Level 1
1.1.1 Ensure that the --allow-privileged argument is set to falseUnixCIS Kubernetes 1.7.0 Benchmark v1.1.0 L1
1.1.10 Ensure noexec option set on /var/tmp partitionUnixCIS SUSE Linux Enterprise Workstation 11 L1 v2.1.0
1.1.10 Ensure noexec option set on /var/tmp partitionUnixCIS Amazon Linux v2.1.0 L1
1.1.10 Ensure noexec option set on /var/tmp partitionUnixCIS SUSE Linux Enterprise Server 11 L1 v2.1.0
1.1.10 Ensure separate partition exists for /varUnixCIS Ubuntu Linux 18.04 LTS Workstation L2 v2.1.0
1.1.10 Ensure separate partition exists for /varUnixCIS Ubuntu Linux 18.04 LTS Server L2 v2.1.0
1.1.10 Ensure that the admission control plugin AlwaysAdmit is not setUnixCIS Kubernetes 1.11 Benchmark v1.3.0 L1
1.1.10 Ensure that the admission control plugin AlwaysAdmit is not setUnixCIS Kubernetes 1.13 Benchmark v1.4.1 L1
1.1.10 Ensure that the admission control policy is set to AlwaysPullImagesUnixCIS Kubernetes 1.8 Benchmark v1.2.0 L1
1.1.10 Ensure that the Container Network Interface file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.0 L1 Master
1.1.11 Ensure that the admission control plugin AlwaysPullImages is setUnixCIS Kubernetes 1.11 Benchmark v1.3.0 L1
1.1.11 Ensure that the admission control policy is not set to AlwaysAdmitUnixCIS Kubernetes 1.7.0 Benchmark v1.1.0 L1
1.1.11 Ensure that the admission control policy is set to DenyEscalatingExecUnixCIS Kubernetes 1.8 Benchmark v1.2.0 L1
1.1.12 Ensure /var/tmp partition includes the nodev optionUnixCIS Ubuntu Linux 18.04 LTS Server L1 v2.1.0
1.1.12 Ensure /var/tmp partition includes the nodev optionUnixCIS Ubuntu Linux 18.04 LTS Workstation L1 v2.1.0
1.1.12 Ensure that only organizationally managed/approved public groups existmicrosoft_azureCIS Microsoft 365 Foundations E3 L2 v1.4.0
1.1.12 Ensure that the admission control plugin DenyEscalatingExec is setUnixCIS Kubernetes 1.11 Benchmark v1.3.0 L1
1.1.12 Ensure that the admission control policy is set to AlwaysPullImagesUnixCIS Kubernetes 1.7.0 Benchmark v1.1.0 L1
1.1.12 Ensure that the admission control policy is set to SecurityContextDenyUnixCIS Kubernetes 1.8 Benchmark v1.2.0 L1
1.1.13 Ensure /var/tmp partition includes the nosuid optionUnixCIS Ubuntu Linux 18.04 LTS Workstation L1 v2.1.0
1.1.13 Ensure /var/tmp partition includes the nosuid optionUnixCIS Ubuntu Linux 18.04 LTS Server L1 v2.1.0
1.1.13 Ensure nodev option set on /home partitionUnixCIS Ubuntu Linux 14.04 LTS Workstation L1 v2.1.0
1.1.13 Ensure nodev option set on /home partitionUnixCIS Ubuntu Linux 14.04 LTS Server L1 v2.1.0
1.1.13 Ensure that collaboration invitations are sent to allowed domains onlymicrosoft_azureCIS Microsoft 365 Foundations E3 L2 v1.4.0
1.1.13 Ensure that the admission control plugin SecurityContextDeny is setUnixCIS Kubernetes 1.11 Benchmark v1.3.0 L1
1.1.13 Ensure that the admission control plugin SecurityContextDeny is setUnixCIS Kubernetes 1.13 Benchmark v1.4.1 L1
1.1.13 Ensure that the admission control policy is set to DenyEscalatingExecUnixCIS Kubernetes 1.7.0 Benchmark v1.1.0 L1
1.1.13 Ensure that the admission control policy is set to NamespaceLifecycleUnixCIS Kubernetes 1.8 Benchmark v1.2.0 L1
1.1.14 Ensure /var/tmp partition includes the noexec optionUnixCIS Ubuntu Linux 18.04 LTS Workstation L1 v2.1.0
1.1.14 Ensure /var/tmp partition includes the noexec optionUnixCIS Ubuntu Linux 18.04 LTS Server L1 v2.1.0
1.1.14 Ensure nodev option set on /home partitionUnixCIS SUSE Linux Enterprise Server 11 L1 v2.1.0
1.1.14 Ensure nodev option set on /home partitionUnixCIS Amazon Linux v2.1.0 L1
1.1.14 Ensure nodev option set on /home partitionUnixCIS SUSE Linux Enterprise Workstation 11 L1 v2.1.0
1.1.14 Ensure nodev option set on /run/shm partitionUnixCIS Ubuntu Linux 14.04 LTS Server L1 v2.1.0
1.1.14 Ensure nodev option set on /run/shm partitionUnixCIS Ubuntu Linux 14.04 LTS Workstation L1 v2.1.0
1.1.14 Ensure that the admin.conf file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.0 L1 Master
1.1.14 Ensure that the admission control plugin NamespaceLifecycle is setUnixCIS Kubernetes 1.11 Benchmark v1.3.0 L1
1.1.14 Ensure that the admission control plugin NamespaceLifecycle is setUnixCIS Kubernetes 1.13 Benchmark v1.4.1 L1
1.1.14 Ensure that the admission control policy is set to SecurityContextDenyUnixCIS Kubernetes 1.7.0 Benchmark v1.1.0 L1
1.1.15 Ensure nodev option set on /dev/shm partitionUnixCIS Amazon Linux v2.1.0 L1
1.1.15 Ensure nodev option set on /dev/shm partitionUnixCIS SUSE Linux Enterprise Server 11 L1 v2.1.0
1.1.15 Ensure nodev option set on /dev/shm partitionUnixCIS SUSE Linux Enterprise Workstation 11 L1 v2.1.0
1.1.15 Ensure nosuid option set on /run/shm partitionUnixCIS Ubuntu Linux 14.04 LTS Workstation L1 v2.1.0
1.02 Windows Oracle Local Account - 'Use Restricted Service Account (RSA)'WindowsCIS v1.1.0 Oracle 11g OS Windows Level 1
1.03 Windows Oracle Domain Account - 'Use Restricted Service Account (RSA)'WindowsCIS v1.1.0 Oracle 11g OS Windows Level 1
1.04 Windows Oracle Account - 'Deny Log on Locally Right'WindowsCIS v1.1.0 Oracle 11g OS Windows Level 1
1.05 Windows Oracle Domain Global Group - 'Create a global group for the RSA and make it the RSA's primary group'WindowsCIS v1.1.0 Oracle 11g OS Windows Level 1
1.06 Windows Oracle Account Domain Users Group Membership - 'Remove the RSA from the Domain Users group'WindowsCIS v1.1.0 Oracle 11g OS Windows Level 1