2 cissp ® Official Study Guide Eighth Edition

Policy Mechanisms
As with any security program, policy mechanisms should also be put into place. These 
mechanisms are extensions of basic computer security doctrine, but the applications 
described in this section are specific to the field of computer architecture and design.
Principle of Least Privilege
Chapter 13, “Managing Identity and Authentication,” discusses the general security 
princi-
ple of least privilege
and how it applies to users of computing systems. This principle is also 
important to the design of computers and operating systems, especially when applied to 
system modes. When designing operating system processes, you should always ensure that 
they run in user mode whenever possible. The greater the number of processes that execute 
in privileged mode, the higher the number of potential vulnerabilities that a malicious 
individual could exploit to gain supervisory access to the system. In general, it’s better to 
use APIs to ask for supervisory mode services or to pass control to trusted, well-protected 
supervisory mode processes as they’re needed from within user mode applications than it is 
to elevate such programs or processes to supervisory mode altogether.

---

384
Chapter 9 
■
Security Vulnerabilities, Threats, and Countermeasures
Separation of Privilege
The principle of 
separation of privilege
builds on the principle of least privilege. It requires 
the use of granular access permissions; that is, different permissions for each type of 
privileged operation. This allows designers to assign some processes rights to perform 
certain supervisory functions without granting them unrestricted access to the system. It 
also allows individual requests for services or access to resources to be inspected, checked 
against access controls, and granted or denied based on the identity of the user making the 
requests or on the basis of groups to which the user belongs or security roles that the user 
occupies.
Think of separation of duties as the application of the principle of least privilege to 
administrators. In most moderate to large organizations, there are many administrators, 
each with different assigned tasks. Thus, there are usually few or no individual administra-
tors with complete and total need for access across the entire environment or infrastruc-
ture. For example, a user administrator has no need for privileges that enable reconfiguring 
network routing, formatting storage devices, or performing backup functions.
Separation of duties is also a tool used to prevent conflicts of interest in the assignment 
of access privileges and work tasks. For example, those persons responsible for program-
ming code should not be tasked to test and implement that code. Likewise, those who work 
in accounts payable should not also have accounts receivable responsibilities. There are 
many such job or task conflicts that can be securely managed through the proper imple-
mentation of separation of duties.