| The concept of least privilege is applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Accounts used to perform security-related functions must not be used to perform non-privileged functions on the firewall. Processes that support security functions are especially critical to secure with granular or fine-grained privileges. These processes include mechanisms involved with configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.
Auditing the use of accounts for non-privileged security functions is not a firewall function. |
