Key takeaways
- Restrict tools that can override system or application controls.
- Powerful utility programs can bypass normal controls.
- Start here: identify utilities that can override security.
Purpose
Restrict tools that can override system or application controls.
Requirement
Requirement summaryThe use of utility programs that can be capable of overriding system and application controls shall be restricted and tightly controlled.
Why it matters
Powerful utility programs can bypass normal controls.
How to implement
- Identify utilities that can override security.
- Restrict their use to authorised people.
- Log use of such tools.
- Remove unnecessary utilities.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.18. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for powerful utility programs that can override security settings.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.18 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list of who can use these programs, with approvals.
- Settings restricting their use to authorized people.
- Logs showing when they were used.
- Records of regular reviews of who has access.
Things you should be able to show or explain
- Be able to explain why each person needs access.
How much to show: All users with access to these tools.
Common mistakes
- Anyone can run powerful tools.
- No record of use.
- Admin tools installed for all users.
- No logging of their use.
- Tip: Remove or lock down admin utilities on endpoints.
Policies & documents to have
- Access Control Policy
- Operations Security Policy
FAQ
Is A.8.18 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.18?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for powerful utility programs that can override security settings…