A.8.18 Technological
Use of privileged utility programs
AttributesPreventiveC·I·AProtectSystem and network securitySecure configurationApplication securityProtection
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (11)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-3mostlyaligns with — Both enforce that privileged utility functions are executed only after explicit identification, authentication, and authorization checks.
- AC-6mostlyaligns with — Both controls restrict the assignment and use of elevated privileges to the smallest set of trusted users and limit the duration and scope of those privileges.
- AU-2mostlyaligns with — Both require that every invocation of privileged utilities is captured in an audit log for subsequent review.
- AC-5partialaligns with — Both prevent users who already hold application privileges from also holding utility-program privileges that could compromise segregation of duties.
- CM-7partialaligns with — Both mandate the removal or disabling of unnecessary privileged utilities to reduce the attack surface.
Aligned NIST CSF 2.0 outcomes (12)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.AA-01mostlyaligns with — By requiring unique identification and authentication for every use of privileged utilities, the ISO control fulfills the CSF requirement to manage identities and credentials for authorized users and services.
- PR.AA-05mostlyaligns with — The ISO control restricts and authorizes privileged utility access through defined permission levels, reviews, and enforcement mechanisms that directly support the CSF outcome of managing and reviewing access entitlements.
- PR.PS-04mostlyaligns with — Mandating comprehensive logging of all privileged utility activity provides the log records the CSF outcome expects to be generated and made available for continuous monitoring.
- PR.IR-01partialaligns with — Segregating utility programs from application software and network traffic limits unauthorized logical access, supporting the CSF outcome of protecting networks and environments.
- PR.PS-05partialaligns with — Removing or disabling unnecessary utility programs reduces the attack surface and prevents unauthorized execution, which partially satisfies the CSF goal of blocking unauthorized software.
Related OWASP ASVS 5.0 requirements (10)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V13.2.3partialaligns with — Requiring unique identification and authentication before any utility program is executed aligns with the ASVS rule that service-to-service credentials must never be default or shared accounts.
- V13.3.2partialaligns with — Limiting utility-program access to the smallest practical set of users embodies the principle-of-least-privilege control that ASVS V13.3.2 demands for secret-asset access.
- V16.3.2partialaligns with — The explicit logging of every utility-program invocation provides the audit trail that ASVS V16.3.2 expects for all failed and successful authorization decisions.
- V8.2.1partialaligns with — The ISO control's requirement to restrict utility programs to trusted, authorized users and to define authorization levels directly supports the ASVS mandate that function-level access be granted only to consumers with explicit permissions.
- V8.3.1partialaligns with — By insisting that utility programs be invoked only through trusted service-layer authorization rather than client-side checks, the ISO guidance mirrors the ASVS requirement to enforce authorization decisions at a trusted backend.
Related weaknesses / CWE (53)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-250mostlyprevents — Restricting privileged utilities to the fewest trusted users and requiring explicit authorization directly stops developers or operators from embedding or invoking code that runs with unnecessary elevated rights.
- CWE-267mostlymitigates — Use of privileged utility programs restricts dangerous tools but does not address unsafe actions within assigned privileges.
- CWE-1234partialmitigates — Restricting privileged utility programs limits debug access, but does not guarantee hardware lock protection.
- CWE-1244partialmitigates — Privileged utility programs may include debug tools, but the control does not address hardware debug access levels.
- CWE-1256partialmitigates — Restricting privileged utility programs limits exposure of low-level hardware interfaces that could be abused for memory or register manipulation.
- CWE-1262partialmitigates — Privileged utility programs may touch registers, so the control partially mitigates misuse.
- CWE-1274partialmitigates — Restricting privileged utilities reduces the chance of tampering with boot code in volatile memory.
- CWE-15partialprevents — Use of privileged utility programs is controlled to prevent misuse of configuration tools.
- CWE-266partialmitigates — Restricting privileged utility programs limits exposure from over-privileged accounts but does not address how privileges are assigned.
- CWE-268partialmitigates — Controlling privileged utility programs reduces opportunities for chaining privileges to perform unsafe actions.
- CWE-269partialmitigates — Defining and enforcing documented authorization levels for each utility program prevents the assignment of excessive privileges that would let an attacker abuse those utilities beyond their intended scope.
- CWE-270partialmitigates — Restricting privileged utilities reduces exposure to context-switch privilege errors.
- CWE-272partialmitigates — Restricts and monitors privileged utility programs, directly addressing the need to drop elevated rights immediately after use.
- CWE-274partialmitigates — Restricting privileged utilities reduces exposure but does not address how the application handles privilege shortfalls.
- CWE-279partialmitigates — Restricting privileged utility programs reduces the chance that such tools will incorrectly alter object permissions.
- CWE-284partialmitigates — Requiring identification, authentication, and authorization before any use of a privileged utility blocks unauthorized actors from reaching the control points that bypass normal access restrictions.
- CWE-412partialmitigates — Restricting privileged utilities can limit external lock manipulation but does not address the core weakness.
- CWE-732partialprevents — Removing or disabling unnecessary utilities and logically segregating the remaining ones reduces the chance that default or permissive file permissions will expose powerful system-modifying tools to untrusted processes or users.
- CWE-1191nonenone — Privileged utility programs could include debug tools, yet the control is software-oriented.
- CWE-1220nonenone — Limits use of privileged utilities; overly coarse access rules can still allow unauthorized utility access.
- CWE-1268nonenone — Restricts privileged utility programs, indirectly reducing risk of inconsistent privilege use but not addressing policy mapping.
- CWE-1393nonenone — Utility programs often ship with defaults; control requires secure configuration before use.
- CWE-214nonenone — Restricting privileged utility programs reduces the chance that sensitive invocation data is exposed to other processes.
- CWE-271nonemitigates — Restricting use of privileged utility programs forces explicit privilege lowering before handing control to unprivileged actors.
- CWE-273nonenone — Control of privileged utility programs includes ensuring privilege-dropping operations are verified before use.
- CWE-277nonenone — Restricting privileged utility programs may limit exposure but does not address permission inheritance weaknesses.
- CWE-280nonenone — Restricts privileged utility programs, indirectly lowering exposure to privilege-handling flaws.
- CWE-422nonenone — Restricting use of privileged utility programs limits the number of elevated processes that could be exploited through unprotected Windows messages.
- CWE-520nonenone — Controls on privileged utility programs reduce the attack surface for impersonation misuse, yet fixing the weakness itself does not satisfy the control's wider intent.
- CWE-528nonenone — Restricting privileged utilities limits who can generate or inspect core dumps, but does not govern their storage location.
- CWE-530nonenone — Privileged-utility restrictions may limit who can restore backups, but do not govern backup storage exposure.
- CWE-556nonenone — Control of privileged utility programs reduces the risk of unnecessary impersonated credentials being used for elevated operations.
- CWE-648nonemitigates — Restricting privileged utility programs limits the exposure of privileged APIs to misuse.
- CWE-689nonenone — Limits use of privileged utilities that could exploit interim permissions during copy.
- CWE-749nonenone — Restricting privileged utility programs reduces exposure of dangerous functions, but does not eliminate the underlying weakness.
- CWE-778nonenone — Mandating comprehensive logging of every invocation of privileged utilities creates an audit trail that makes post-incident detection and accountability feasible when abuse occurs.
- CWE-782nonenone — Restricting privileged utilities reduces the attack surface for exposed IOCTLs.
Mitigated MITRE ATT&CK techniques (5)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1053partialmitigates — Limiting and authorizing utility programs reduces the chance an attacker can use privileged scheduling tools to create or modify scheduled tasks or systemd timers for persistence or execution.
- T1078partialmitigates — Enforcing unique identification, authentication, and documented authorization levels for utility programs makes it harder for attackers to abuse valid privileged accounts without detection.
- T1543partialmitigates — Segregating and disabling unnecessary privileged utilities reduces opportunities for an adversary to create or modify system services or daemons for persistence.
- T1548partialprevents — Restricting and logging privileged utility programs directly limits an adversary's ability to abuse elevation mechanisms such as sudo, UAC bypasses, or setuid binaries.
- T1569nonemitigates — Requiring explicit authorization and logging for privileged utilities curbs an adversary's ability to leverage service-control binaries to start or stop services for execution or impact.
Prevented OWASP Web Top 10 (2025) risks (4)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A01partialprevents — Restricting who can run privileged utilities and requiring explicit authorization reduces the chance that an attacker or insider can bypass normal access checks to reach protected functions or data.
- A02partialprevents — Disabling or removing unnecessary utilities and enforcing logical segregation stops default or leftover tools from remaining active with excessive rights, which is a common source of dangerous configuration drift.
- A07nonemitigates — Mandating unique identification, authentication, and documented authorization levels for every utility session limits the abuse of privileged accounts that often bypass normal login controls.
- A09nonemitigates — Requiring that every execution of a privileged utility is logged supplies the audit trail needed to detect and investigate unauthorized or anomalous privileged activity.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.