This control establishes guidelines that govern the use of any utility program that has the potential to override business critical system and application controls. The use of utility programs that might be capable of overriding system and application controls shall be restricted and tightly controlled. None out of the organization shall be sharing any sort of confidential details. Use of utility programs (an application that performs computer management tasks such as virus protection, password management, file compression, etc.),or other software that might be capable of overriding system and application controls or altering system configurations must be restricted. Management approval is required prior to the installation or use of any ad hoc or third-party system utilities. A utility program is any piece of software that is designed to analyse or maintain a computer system or network. Examples of utility programs include:
- Diagnostic tools
- Patching assistants
- Antivirus programs
- Disk defragmenters
- Backup software
- Networking tools
Utility programs are essential to the smooth running of any given LAN or WAN, and help network administrators to improve up time and increase resilience across a broad range of commercial functions. Given their intrusive nature, utility programs also have the potential to cause a significant amount of damage on a given network, unless their use is properly monitored.The Internet is bombarded with different utility programs, all seeking to help you stay organised. Yet many of these software programs are viruses and malware that hacker’s prey on to get into your system and even target your antivirus software and before you know it, they have access to confidential files. ISO 27001 warns against downloading random utility programs to your system. Those you used must be verified by competent staff and checked for any possible spyware, malware or insecure code. If the program is required, then only a small group of personnel should have privileged access rights to the software and its use monitored.
Control
The use of utility programs that can be capable of overriding system and application controls should be restricted and tightly controlled.
Purpose
To ensure the use of utility programs does not harm system and application controls for information security.
ISO 27002 Implementation Guidance
The following guidelines for the use of utility programs that can be capable of overriding system and application controls should be considered:
- limitation of the use of utility programs to the minimum practical number of trusted, authorized users ;
- use of identification, authentication and authorization procedures for utility programs, including unique identification of the person who uses the utility program;
- defining and documenting of authorization levels for utility programs;
- authorization for ad hoc use of utility programs;
- not making utility programs available to users who have access to applications on systems where segregation of duties is required;
- removing or disabling all unnecessary utility programs;
- at a minimum, logical segregation of utility programs from application software. Where practical, segregating network communications for such programs from application traffic;
- limitation of the availability of utility programs (e.g. for the duration of an authorized change);
- logging of all use of utility programs.
Other information
Most information systems have one or more utility programs that can be capable of overriding system and application controls, for example diagnostics, patching, antivirus, disk defragmenters, debuggers, backup and network tools.
Utility computer programmes that might be capable of overriding system and application controls need to be carefully managed.
Powerful system and network utility programs can create an attractive target for malicious attackers and access to them must be restricted to the smallest number of people. As such utility programs can be easily located and downloaded from the internet it is also important that users are restricted in their ability to install any software as much as possible weighed against business requirements and risk assessment. Use of utility programs should be logged and monitored/reviewed periodically to satisfy auditor requests. In order to maintain network integrity and bolster business continuity, organisations should:
- Restrict the use of utility programs to employees and IT maintenance staff who specifically require them to carry out their job role.
- Ensure that all utility programs are identified, authenticated and authorised in line with business requirements, and management are able to gain a top down view of their use at any given time.
- Identify all personnel who use utility programs, either as part of their daily duties, or on an ad-hoc basis.
- Implement adequate authorisation controls for any employee who needs to use utility programs, either as part of their daily duties, or on an ad-hoc basis.
- Prevent the use of utility programs on any system where the organisation has deemed it necessary to segregate duties.
- Periodically review the use of utility programs, and either remove or disable any programs as the organisation requires.
- Partition utility programs are distinct from standard applications that the business uses on a regular basis, including network traffic.
- Restrict the availability of utility programs, and only use them for express purposes
A utility program is usually smaller than a standard application and refers to a program that is responsible for managing system resources and adding functionality to your computer. This can include screen savers, icon tools and other desktop enhancement features. A privileges utility program is an application that requires elevated (administrative) privileges to perform the specific task. This can include endpoint security tools, such as anti-virus software, software updates, device/process managers, disk encryption and software firewalls. Allowing employees access to privileged utilities from their standard user account introduces security risks into the network. This allows malware to cause much more damage as it can run with the privileges of the utility program. Therefore, it is advised to ensure that administrative accounts are not utilized to conduct daily business functions such as sending e-mails and browsing the web. These accounts must only be utilized when conducting tasks that require admin privileges. Equally, standard users should not be given administrative rights over specific utilities/programs. If a standard user account is used and a privileged utility program is executed, it will prompt the User Access Control (UAC) and administrative credentials will need to be entered. Access to privileged utility programs should be heavily restricted to employees except those who require it to perform their daily tasks. If the user requests access to a privileged utility, justification should be provided, and it should be reviewed by a person with authority within the organisation. Additionally, it is advised to identify and disable all unnecessary utility programs on the machines as well as monitor and review the event logs on a regular basis in order to identify any suspicious behavior or mis-assignment of correct account privileges within the organisation.
The organization must restrict access to privileged utility programs and control utility program access to systems and applications, by controlling access to the privileged account credentials stored securely in the digital vault. Access can be restricted to a certain time period and can be disabled when not in use. “Dual Control” can specify that access to highly sensitive credentials requires confirmation by one or more authorized users. As well, administrators can be granted authorized access to resources but never see the privileged account password in clear text. Many utility programs involve the use of service accounts; services such as back-up or vulnerability scanning require privileged access to systems. To perform their designated tasks such as retrieve, process, transmit and store sensitive data, these programs require high levels of access to running processes. Service accounts are difficult to secure since the credentials are typically hard-coded and in clear text within the programs. The solution must eliminate hard-coded passwords from utility programs and uses an advanced means to authenticate the programs that are requesting credentials. Access to be granted only to trusted programs, with no impact to performance or downtime. The solution must provide a tamper-proof audit record to track all privileged account access to utility programs and all utility program service account access to systems.
