Understanding ISO 27002 Control 8.18: Securing Privileged Utility Programs
A utility program is any piece of software that is designed to analyse or maintain a computer system or network.
Examples of utility programs include:
- Diagnostic tools
- Patching assistants
- Antivirus programs
- Disk defragmenters
- Backup software
- Networking tools
Utility programs are essential to the smooth running of any given LAN or WAN, and help network administrators to improve uptime and increase resilience across a broad range of commercial functions.
Given their intrusive nature, utility programs also have the potential to cause a significant amount of damage on a given network, unless their use is properly monitored.
Purpose of Control 8.18
Control 8.18 is a preventive control that maintains risk by establishing guidelines that govern the use of any utility program that has the potential to override business critical system and application controls.
Attributes Table of Control 8.18
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality | #Protect | #System and Network Security | #Protection |
| #Integrity | #Secure Configuration | |||
| #Availability | #Application Security |
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
Ownership of Control 8.18
Control 8.18 deals primarily with the operation of back-end networking, maintenance and diagnostic tools. As such, ownership should reside with the person responsible for the organisation’s IT infrastructure, such as the Head of IT.
General Guidance on Compliance
Control 8.18 offers 9 main guidance points for organisations seeking to monitor the use of utility programs across their network.
In order to maintain network integrity and bolster business continuity, organisations should:
- Restrict the use of utility programs to employees and IT maintenance staff who specifically require them to carry out their job role.
- Ensure that all utility programs are identified, authenticated and authorised in line with business requirements, and management are able to gain a top down view of their use at any given time.
- Identify all personnel who use utility programs, either as part of their daily duties, or on an ad-hoc basis.
- Implement adequate authorisation controls for any employee who needs to use utility programs, either as part of their daily duties, or on an ad-hoc basis.
- Prevent the use of utility programs on any system where the organisation has deemed it necessary to segregate duties.
- Periodically review the use of utility programs, and either remove or disable any programs as the organisation requires.
- Partition utility programs are distinct from standard applications that the business uses on a regular basis, including network traffic.
- Restrict the availability of utility programs, and only use them for express purposes.
- Log the use of utility programs, including timestamps and authorised users.
Free yourself from a mountain of spreadsheets
Embed, expand and scale your compliance, without the mess. IO gives you the resilience and confidence to grow securely.
Changes and Differences from ISO 27002:2013
27002:2022-8.18 replaces 27002:2003-9.4.4 (Use of privileged utility programs) with no changes made between either version.
New ISO 27002 Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | NEW | Threat intelligence |
| 5.23 | NEW | Information security for use of cloud services |
| 5.30 | NEW | ICT readiness for business continuity |
| 7.4 | NEW | Physical security monitoring |
| 8.9 | NEW | Configuration management |
| 8.10 | NEW | Information deletion |
| 8.11 | NEW | Data masking |
| 8.12 | NEW | Data leakage prevention |
| 8.16 | NEW | Monitoring activities |
| 8.23 | NEW | Web filtering |
| 8.28 | NEW | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | NEW | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
How ISMS.online Helps
Our platform provides you with customised dashboards that give you real-time visibility into your compliance status.
You can monitor and manage all aspects of your ISO 27002 compliance journey from one place – audit management, gap analysis, training management, risk assessment etc.
It provides an easy-to-use, integrated solution that can be accessed on a 24/7 basis via any device with an internet connection. The platform allows all employees to work together seamlessly and securely to manage security risks and track the organisation’s compliance, as well as the journey towards ISO 27001 certification.
Get in touch today to book a demo.
