Manage privilege modifications
Summary
The system must not allow system actors to modify privileges for themselves.
Description
Systems should have a set of roles with different levels of privilege to access resources. The privileges of each role must be clearly defined and the role of each user should also be clearly stated. Furthermore, users should not be allowed to modify their own privileges, as this could be leveraged to access otherwise restricted functionalities and resources.
Supported In
This requirement is verified in following services
| Plan | Supported |
|---|---|
| Machine | 🔴 |
| Squad | 🟢 |
References
- CAPEC™-233. Privilege escalation
- CAPEC™-690. Metadata Spoofing
- CWE™-267. Privilege defined with unsafe actions
- CWE™-269. Improper privilege management
- CWE™-639. Authorization bypass through user-controlled key
- OWASP TOP 10-A1. Broken access control
- OWASP-M TOP 10-M6. Insecure authorization
- NIST Framework-PR_AC-1. Identities and credentials are issued, managed, verified, revoked and audited for authorized devices, users and processes
- NIST Framework-DE_DP-1. Roles and responsibilities for detection are well defined to ensure accountability
- BIZEC-APP-APP-06. Direct database modifications
- MITRE ATT&CK®-M1024. Restrict registry permissions
- MITRE ATT&CK®-M1026. Privileged account management
- MITRE ATT&CK®-M1039. Environment variable permissions
- MITRE ATT&CK®-M1052. User account control
- MITRE ATT&CK®-M1056. Pre-compromise
- PA-DSS-3_4. Limit access to required functions/resources and enforce least privilege for built-in accounts
- PA-DSS-5_2_8. Improper access controls
- SANS 25-16. Missing Authorization
- CMMC-AC_L1-3_1_1. Authorized access control
- CMMC-AC_L2-3_1_4. Separation of duties
- CMMC-AC_L2-3_1_7. Privileged functions
- HITRUST CSF-01_c. Privilege management
- FedRAMP-AC-6_1. Least privilege - Authorize access to security functions
- FedRAMP-CM-5_5. Access restrictions for change - Limit production, operational privileges
- ISO/IEC 27002-8_2. Privileged access rights
- OSSTMM3-9_15_3. Wireless security (privileges audit) - Escalation
- WASC-A_12. Content spoofing
- WASC-W_02. Insufficient authorization
- ISSAF-A_2_4. Assessment - Penetration
- ISSAF-P_6_15. Host security - Linux security (local attacks)
- ISSAF-Q_16_20. Host security - Windows security (local attacks)
- ISSAF-Y_3_4. Database Security - Database services countermeasures
- OWASP Top 10 Privacy Risks-P2. Operator-sided data leakage
- BSAFSS-AA_1-2. Authorization and access controls
- BSAFSS-AA_2-1. Authorization and access (support controls)
- CWE TOP 25-862. Missing authorization
- SWIFT CSCF-5_1. Logical access control
- C2M2-9_5_h. Implement data security for cybersecurity architecture
- PCI DSS-7_2_3. Required privileges are approved by authorized personnel
- OWASP API Security Top 10-API1. Broken Object Level Authorization
- ISO/IEC 27001-8_2. Privileged access rights
Vulnerabilities
Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.