ASD ISM 2046 Ensure secure impersonation logging practices
What it says
Where software allows user impersonation, sensitive data is not logged and appropriate permissions are set.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure no sensitive information is recorded in logs and permissions are correctly set when users can impersonate others.
This control ensures that when someone in your organisation can act on behalf of another person, no private information gets recorded in logs. If not managed properly, it risks accidentally exposing sensitive data or causing unauthorised access to important parts of your system.
Free. Save your status, tasks and notes.
Why it matters
Insecure impersonation logging can record sensitive data (e.g. passwords, message content) and expose it to unauthorised users, causing data breaches.
How to implement
System Owners should check the logging settings: Make sure that logs do not store sensitive information like passwords or personal details when users impersonate others.
Use your logging software's settings to filter out any data that shouldn't be recorded.
IT Teams need to evaluate permissions: Ensure that only authorised personnel can impersonate other users by setting proper access permissions using clear, role-based guidelines.
Review these permissions regularly to keep them current.
Managers should implement training: Conduct workshops to teach staff about the importance of not logging sensitive data and understanding their role when given permission to impersonate others.
Use real-world examples to highlight potential risks.
Developers should configure software appropriately: Adjust the settings of any software that allows impersonation to disable logging of sensitive information.
This may involve changing configurations or using specialised settings provided by the software vendor.
HR should oversee access reviews: Periodically review who has permission to impersonate others and ensure it's still necessary for their role.
Remove access for employees who no longer require it to perform their duties.
Keep it running
Audit impersonation logs and events to confirm no sensitive fields are captured, and restrict log access to authorised roles with least privilege.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
User access logs: Request logs that show impersonation activity within the system.
Look at
The details to ensure no sensitive information is present. Good result: Logs contain only necessary information, like timestamps and user IDs, without personal or sensitive details.
- Check 2 of 5What an auditor asks for
Ask for
The list of authorised impersonators: Request the document or list detailing who has been granted impersonation rights.
Look at
Roles and individuals that are validly authorised. Good result: The list is current, and permissions match job roles.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request evidence of completed training sessions about impersonation and logging practices.
Look at
Attendance and curriculum to confirm relevance and thoroughness. Good result: Comprehensive records showing regular training sessions attended by all relevant employees.
- Check 4 of 5What an auditor asks for
Ask for
A permissions audit report: Request documentation of recent checks on impersonation rights.
Look at
The findings to ensure no unnecessary permissions remain. Good result: A recent, thorough audit showing all changes logged and actions taken.
- Check 5 of 5What an auditor asks for
Ask for
Software configuration settings: Request the configuration files or settings that control impersonation features in software.
Look at
Settings that disable logging of sensitive data. Good result: Clear, documented settings that align with security recommendations.
Mappings
Closest match in ISO/IEC 27001: A.8.26, Defining security requirements for applications, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.8.26.
ISM-2046 demands that impersonation features do not result in sensitive data being logged, with appropriate permissions set on the logs. Annex A 8.26 is broader, requiring security requirements to be identified when developing or acquiring applications, potentially including log redaction and access restrictions for impersonation functions. ISM-2046 represents a specific application requirement under the broader scope of Annex A 8.26.
This control partially overlaps A.8.3.
ISM-2046 requires systems with impersonation capability to prevent sensitive data from being logged and to enforce appropriate permissions on resulting logs. Annex A 8.3 supports this by requiring access to information and associated assets to be restricted according to access control policy, directly underpinning the restriction of access to impersonation logs and features. Annex A 8.3, however, does not address the key ISM-2046 requirement to minimise sensitive content within logs.
This control partially overlaps A.8.15.
ISM-2046 requires secure logging practices in impersonation scenarios, such as preventing sensitive data from being logged and ensuring appropriate permissions. Annex A 8.15 overlaps by requiring logs to be produced, stored, protected, and analysed, which includes controlling access to logs and protecting them from tampering. However, Annex A 8.15 is broader, and does not explicitly require suppression or redaction of sensitive data in logs for impersonation use cases as ISM-2046 does.
This control depends on A.5.34.
ISM-2046 requires sensitive data not to be logged and ensures that permissions are set appropriately in software that allows user impersonation. Annex A 5.34 supports this by establishing obligations to protect PII, which often drives requirements to avoid capturing sensitive fields in logs and to restrict log access. Annex A 5.34 is compliance-focused and does not directly specify logging controls or impersonation-specific log permissioning like ISM-2046.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.