User permissions in systems
Limit and control functionality within systems with user permissions. Assign permissions to users based on specific business needs, such as making high-risk functions limited to specialised users. The Protective Security Policy Framework sets out the government protective security policies that support this countermeasure.
Why this countermeasure matters
Not controlling system functionality with user permissions can lead to:
- staff facilitating fraudulent payments
- staff accessing, manipulating and disclosing information without a business need
- staff processing fraudulent requests or claims for themselves or another person
- criminals coercing staff into providing information.
How you might apply this countermeasure
Some ways to implement this countermeasure include:
- limiting access to functionality within systems to specific permissions
- requiring a business case and approval to obtain specific permissions
- making sure only certain teams have access to certain functions, such as only payroll staff having access to payroll functions and information
- blocking staff from accessing their own records
- only allowing authenticated clients of authorised representatives to perform functions on a client’s record.
How to check if your countermeasures are effective
Here are some ways to measure the effectiveness of this type of countermeasure:
- confirm controls comply with the Protective Security Policy Framework. This includes security requirements for:
- sensitive and classified information
- access to information
- safeguarding information from cyber threats
- robust ICT systems.
- confirm the existence of permissions and limits within the system.
- review procedures or guidance to confirm it clearly specifies where permissions should be limited.
- obtain and review requirements for who should have certain user permissions.
- confirm the existence of a request and approvals process for obtaining specific permissions.
- confirm request and approvals processes are consistently applied.
- review procedures for requesting user permissions, confirm the request processes are robust and actively test them if required.
- confirm that someone cannot get around standard process requirements even when subject to pressure or coercion.
- confirm that user permissions consider separation of duties requirements.
- review the need for Security Clearances for some permissions.
- review reports of user permissions to confirm only those who require permissions have the permissions.
- undertake testing or a process walk-through to confirm that permissions within systems work correctly and cannot be ignored.
- confirm the existence of a review and reconciliation process and review the reports.
- review any past access breaches to identify how they were allowed to occur.
This type of countermeasure is supported by: