ASD ISM 1250 Limit server application user account privileges
What it says
The user accounts under which server applications run have limited access to their underlying server's file system.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishServer applications have restricted user account access to the server's file system.
Limiting server applications' user account privileges means ensuring that the software running on your server has access only to what it absolutely needs. This is important because if these applications have too much access, they can be exploited by hackers to reach sensitive data, which could lead to data breaches or business disruptions.
Free. Save your status, tasks and notes.
Why it matters
Excessive application access can lead to data breaches, as compromised apps can exploit unneeded privileges to access sensitive files.
How to implement
IT team: Conduct a review of all server applications to identify what system resources they truly need to function.
Make a list of necessary files and tools each application requires and verify that they don't have access to anything else.
System administrator: Set up restricted accounts for each server application that only grant the minimum privileges necessary for operation.
Use the list made by the IT team to adjust permissions in the server's user account settings.
Business manager: Work with the IT team to understand potential risks associated with server applications running with excessive privileges.
Attend briefings to learn about the security posture and any incidents that occur.
HR department: Ensure that security training includes guidance on the importance of limiting privileges, making employees aware of how privilege misuse can lead to security breaches.
Keep it running
Audit server app run accounts; remove write/admin rights and restrict file paths to only what the app needs. Recheck after updates or config changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Access control lists for server applications: Request the documents showing what specific files and folders each application can access.
Look at
Clearly defined minimum necessary access permissions.
Good evidence
Lists show limited access to essential files only, with no unexplained or broad permissions.
- Check 2 of 5What an auditor asks for
Ask for
A report on server application access reviews: Request documentation of regular reviews of application privileges.
Look at
The dates and outcomes of the reviews.
Good evidence
Up-to-date records with actions taken to adjust permissions based on review findings.
- Check 3 of 5What an auditor asks for
Ask for
Server log records: Request to see logs that track file access attempts by server applications.
Look at
Entries of blocked or failed access attempts.
Good evidence
Logs show consistent monitoring with no successful unauthorised access.
- Check 4 of 5What an auditor asks for
Ask for
A security training curriculum: Request details of employee training sessions that mention privilege limitations.
Look at
The inclusion of privilege management topics.
Good evidence
Training materials that explain risks and procedures for limiting application access.
- Check 5 of 5What an auditor asks for
Ask for
The risk assessment report for server applications: Request documentation evaluating the risk associated with excessive privileges.
Look at
Details on identified threats and mitigation steps.
Good evidence
Comprehensive assessments with clear action steps to address privilege issues.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
ISM-1250 requires organisations to implement least-privilege file system permissions for server application accounts. Annex A 5.15 requires establishing and implementing access control rules and procedures based on business and information security requirements, under which server application account permissions would be defined. ISM-1250 is narrower, focusing on a specific control outcome rather than the full policy/procedure framework in Annex A 5.15.
This control partially meets A.8.3.
ISM-1250 addresses access control by limiting what server application user accounts can do on the server's file system. Annex A 8.3 requires access to information and associated assets to be restricted in accordance with an access control policy, which would include file system access controls for service accounts. ISM-1250 is a specific technical application of the broader access restriction principle in Annex A 8.3.
This control partially overlaps A.8.2.
Annex A 8.2 requires privileged access rights to be restricted and managed to ensure elevated capabilities are tightly controlled. ISM-1250 relates by requiring that server application run-as accounts have limited access to the underlying server file system, effectively reducing privileges granted to service accounts. ISM-1250 is a least-privilege implementation for application accounts on servers, while Annex A 8.2 is broader and also covers human administrator privileges, approval processes and ongoing governance of privileged rights.
ASD Essential Eight: 1 mapping
This control partially meets E8-RA-ML3.1.
E8-RA-ML3.1 requires limiting privileged access so users and services only have what they need to perform duties. ISM-1250 implements least privilege for a particular service context by restricting the file system access of accounts under which server applications run. ISM-1250 is a narrow technical subset (service account file system permissions), whereas E8-RA-ML3.1 applies to privileged access across systems, applications and data repositories.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.