12 new national NIS2 framework versions published! Read more ->
Cyberday back to normal - related blog
Organisation should limit and closely control the use of utility programs that can override system and application controls. This is to prevent any potential harm to information security controls caused by the use of such utility programs. Guidelines include limiting access to trusted users, implementing identification and authentication procedures, documenting authorization levels, and authorizing ad hoc usage.
Privileged utility programs are applications that require system or administrative privilege to do their jobs. Different kinds of utilities can include system utilities (e.g. malware protection), storage utilities (e.g. backup), file management utilities (e.g. encryption) or others (e.g. patching).
If use of privileged utility programs is permitted, the organisation should identify all privileged utility programs, also ones that are used in its cloud computing environment.
Organisation should ensure utility programs don’t interfere with controls of data systems hosted in any way (on-premises or cloud).
.png)
