3.1.7 Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

Privileged functions include establishing system accounts, performing system integrity checks, conducting patching operations, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. Note that this requirement represents a condition to be achieved by the definition of authorized privileges in 3.1.2.

Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Logging the use of privileged functions is one way to detect such misuse, and in doing so, help mitigate the risk from insider threats and the advanced persistent threat.

Actionable Items: Privileged functions are activities that are normally carried out by an Administrator or equivalent security privileges on the network. Keeping this type of access limited to only be used when necessary for maintenance or upgrades is necessary in a healthy environment. Whomever has this access account should have another account also to do regular daily activities and the two functions should never be mixed.