ASD ISM 1746 Restrict file system permission changes
What it says
When implementing application control using path rules, only approved users can change file system permissions for approved files and folders.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly authorised users can change file permissions for approved applications to maintain system security.
This control ensures that only people who are allowed to do so can change the permissions for important files and folders on your computer or server. This is important because if the wrong person changes these permissions, it could make sensitive information vulnerable to being seen or altered by unauthorised people, leading to potential data breaches or system malfunctions.
Free. Save your status, tasks and notes.
Why it matters
If unapproved users can change permissions on approved paths, they can grant access to protected files, enabling data theft or service disruption.
How to implement
The IT team should identify all important applications and files that need special permissions.
They can do this by reviewing the applications and data critical to business operations and ensuring their permissions align with security policies.
Managers should appoint specific users who are authorised to make changes to file permissions.
They can select trusted staff members who understand the importance of this responsibility and ensure they're aware of the security protocols.
System administrators should configure settings to limit who can alter permissions on critical files and folders.
They can achieve this by using system tools to restrict permission changes, ensuring it is only accessible to those who have been authorised.
IT security staff should conduct training for authorised users on how to safely manage permissions.
This involves showing them step-by-step how to check and change permissions without causing security vulnerabilities.
The Compliance Officer or equivalent should regularly review who has permission to change critical file settings.
They can schedule periodic audits and collect feedback to ensure only the right people have this access and that security policies are being followed.
Keep it running
When using path rules, restrict chmod/ACL changes to approved admin groups; review permission change rights and audit logs on approved folders regularly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of applications and files with restricted permissions: Request documentation detailing which files and applications have controlled permission settings.
Look at
Whether this list covers all critical business areas.
Good evidence
Is a comprehensive list showing clear identification of sensitive files.
- Check 2 of 5What an auditor asks for
Ask for
The list of users authorised to change permissions: Review the documentation or system settings showing which users have access.
Look at
Whether the names match those in managerial or IT security roles.
Good evidence
Has an updated list of active, authorised users.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request evidence of training provided to users who can change permissions.
Look at
Dates, attendee names, and training content to ensure they understand their responsibilities.
Good evidence
Includes recent training sessions with well-documented materials.
- Check 4 of 5What an auditor asks for
Ask for
Audit records of permission changes: Request logs or reports showing past permission alterations.
Look at
The timestamps and responsible users for any unauthorised changes.
Good evidence
Includes regularly reviewed and verified logs with appropriate justifications for changes.
- Check 5 of 5What an auditor asks for
Ask for
Policy documents on permission changes: Request the written policies that outline how permission changes should be managed.
Look at
The clarity, effectiveness, and accessibility of these policies.
Good evidence
Includes clear guidelines adhered to by all relevant staff.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
ISM-1746 requires a specific access restriction: only approved users can change file system permissions for approved files and folders used in path-based application control. Annex A 5.15 is broader, requiring organisations to establish and implement access control policies and procedures for logical and physical access based on business and security requirements. ISM-1746 is an implementation-level rule that would typically sit under the access control policy framework mandated by Annex A 5.15.
This control partially overlaps A.8.4.
Annex A 8.4 requires organisations to appropriately manage read and write access to source code, development tools and software libraries. ISM-1746 relates by restricting who can change file system permissions for approved files and folders, which is a concrete mechanism that can protect code and tool locations from unauthorised modification. However, ISM-1746 is specific to application control path-rule implementations and permission changes, while Annex A 8.4 is broader across repositories, toolchains and library access governance (not just filesystem ACL changes).
ASD Essential Eight: 4 mappings
This control supports E8-AC-ML2.1.
E8-AC-ML2.1 requires application control on internet-facing servers to limit execution to approved applications. ISM-1746 is a prerequisite where path rules are used, ensuring only approved users can change file system permissions for approved files and folders so application control cannot be subverted by permission changes. This is conditional dependency: it is essential for secure path-rule deployments but not mandatory for hash- or publisher-based approaches.
This control supports E8-AC-ML2.2.
E8-AC-ML2.2 enforces control excluding certain folders, while ISM-1746 maintains file system integrity, preventing unauthorised permission changes, supporting application control effectiveness.
This control depends on E8-AC-ML1.2.
E8-AC-ML1.2 requires application control in user profile and temporary folders to prevent unapproved execution from those common drop locations. ISM-1746 supports this by restricting who can change file system permissions on approved files and folders when using path rules, helping prevent attackers from weakening controls in user-writable or temporary paths. ISM-1746 is about protecting permissions and rule integrity, while E8-AC-ML1.2 is about ensuring those paths are in-scope for application control.
This control depends on E8-AC-ML3.2.
E8-AC-ML3.2 requires restricting driver execution through application control to an organisation-approved set. ISM-1746 requires that when path rules are used, only approved users can change file system permissions for approved files and folders, preventing attackers from weakening ACLs and replacing trusted binaries/drivers. This underpins the integrity of the approved set and reduces bypass opportunities, making it a prerequisite support condition for effective application control enforcement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.