What do the guidelines of PCI DSS, FDCC, SOX and HIPAA have in common? These mandates, in addition to other commonly implemented regulations, either explicitly demand or at least suggest the use of least privilege security to effectively safeguard data. In terms of compliance, this methodology has a dual benefit – not only does it satisfy auditors, but it will also protect against security breaches that could result in destructive data loss.
As regulatory bodies continue to dictate security initiatives within heavily-regulated industries such as finance and healthcare, least privilege management will play a key role in ensuring companies are in line with internal and external rules. For instance, the Monetary Authority of Singapore (MAS) has Technology Risk Management guidelines, which now place much greater emphasis on endpoint security, particularly with regard to access privileges.
These guidelines now apply to all IT systems among all financial institutions, where they had previously only applied to online services in banking.
As today’s security threats become increasingly sophisticated and targeted, it’s to be expected that least privilege will play a more significant role in mitigating risk as well as helping an organization to achieve compliance. Already, we’re seeing it become more widespread as an essential security measure among a greater variety of sectors and practices.
The MAS guidelines detail a number of system requirements – such as limiting exposure to cyber and man-in-the-middle attacks – that would be very difficult to achieve without a least privilege environment. In fact, the document presents one section dedicated entirely to least privilege. Here, requirements encourage restricting the number of privileged accounts and only granting them on a ‘need-to-have’ basis. The guidelines also encourage the close monitoring of those who are given elevated rights, with regular assessments to ensure they are always appropriately assigned. The principle of “never alone” – where activities involving sensitive information must be jointly carried out by more than one person or performed by one person and authorized by another – may also create challenges for IT teams.
The PCI DSS compliance mandate which was updated in January 2014 (PCI DSS 3.0) has a specific requirement to log activity of privileged users and states that employees with privileged user accounts must be limited to the least set of privileges necessary to perform their job responsibilities.
So, why is it that least privilege is so heavily prescribed in widespread mandates like MAS and PCI DSS? The danger of granting privileges to staff is that it puts them in a good position to implement sophisticated attack methods like logic bombs and stealth scripts, or enable them to crack passwords. Even without malicious intent, staff with elevated privileges could unknowingly introduce malware through unauthorized application downloads.
Organizations that prioritize privilege management won’t just meet compliance, but improve their overall security architecture. Being compliant doesn’t mean you’re secure, but many of the prescribed elements – such as least privilege – will vastly improve your security and provide you with a solid base to build upon.
For more information on achieving compliance, download our whitepaper.
