3.1.7
3.1.7
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
-
5.8.3.1 The organization shall provision accounts with the minimum functionality necessary for tasks and shall restrict administrator privileges to an as-required basis.
5.8.3.2 The organization shall remove accounts and/or functionality when users no longer require these for their tasks.
5.8.3.3 The organization shall only permit administrator accounts to perform administrative activities (and not user-level activities such as accessing email or browsing the web).
5.8.3.4 The organization should consider the implementation of a centralized authorization control system.
6.6.3.1 Organizations shall ensure an appropriate understanding of their security logging capabilities and needs and ensure a corresponding log management policy is in place.
NOTE: NIST SP 800-92, “Guide to Computer Security Log Management” describes considerations for Security Log Management and includes examples. Understanding what data is available and what is missing
is a key step in defining a good log management and incident.