A.8.18
Use of privileged utility programs
Technological controlsCheckpoints 6Evidence 6Cases 6
Control objective
Privileged utility programs are tools capable of overriding or bypassing normal system or application controls such as access control, authorization checks, and logging. This control requires the organization to restrict and tightly govern the possession, installation, and use of such tools, so that unauthorized users cannot exploit them to alter data/systems or evade controls. By ensuring they are used only by the minimum necessary personnel, only when needed, and in a verified/recorded manner, the control protects operational stability and the integrity/confidentiality of information.
Key checkpoints
- Are privileged utility programs that can override system/application controls identified, inventoried, and managed?
- Are there approval procedures for installing/holding/using privileged utility programs and criteria for granting usage rights?
- Are usage rights limited to the minimum personnel who genuinely need them for their work, and are they reviewed periodically?
- Are privileged utility usage actions (who/when/what/why) logged and reviewed?
- Are unnecessary or unused privileged utility programs removed or disabled?
- In environments where application controls are enforced, is the use of tools that can bypass them technically restricted?
Implementation guidance
- Identify and maintain an inventory of programs that can bypass controls, such as operating system administration tools, diagnostic/debugging tools, disk/memory editors, password recovery tools, packet analyzers, and database administration utilities.
- Require prior approval for installing/using privileged utilities, and record the approval rationale, purpose, and duration of use.
- Grant rights only to necessary personnel under the least-privilege principle, and tie shared tools to individual accounts/tokens so that individuals remain identifiable.
- Separate ordinary user rights from privileged utility usage rights, and distinguish everyday work accounts from administration-purpose accounts.
- Log and monitor privileged utility usage, and configure alerts to detect unapproved or abnormal use.
- Remove or disable unused/unnecessary utilities from systems, and restrict access to executables using file permissions/allowlisting.
- By default, isolate/block tools that can bypass application controls (authorization checks, integrity checks, and so on) on operational systems, and permit them only temporarily in a controlled environment when required.
- Allow the use of privileged utilities by external/maintenance personnel only within the contracted/approved scope, and record and supervise their sessions.
Evidence
- Inventory of identified and managed privileged utility programs
- Approval requests and records for installing/using privileged utilities
- Records of granting/revoking usage rights and periodic rights reviews
- Privileged utility usage logs and monitoring/alert records
- Records of removing/disabling unused utilities
- Approval/session records for privileged tool use by external maintenance personnel
Nonconformity examples
- The organization cannot identify or manage which utilities capable of bypassing system controls are installed.
- Personnel install/use privileged utilities at their own discretion with no approval procedure.
- Shared administration tools are used jointly without individual identification, so the acting user cannot be determined.
- No usage logs are kept for privileged utilities, so misuse cannot be verified after the fact.
- Diagnostic/debugging tools are left on operational systems after a project ends and are accessible to anyone.
- Despite application access controls, data is arbitrarily modified by bypassing the controls with a direct database editing tool.