ISO 27001 A.8.18: Use of privileged utility programs

Start by inventorying every privileged utility in your environment. Think operating system tools (PowerShell, bash with sudo, registry editors, disk management), network tools (Wireshark, nmap, tcpdump), security and forensic tools, database utilities with direct SQL access, and development tools like debuggers and decompilers. Lock down access based on role and genuine need. Strip unnecessary utilities from standard workstations and servers. Use application whitelisting to block unauthorised execution of system utilities. Put PowerShell into constrained language mode for standard users and reserve full access for admins. Configure endpoint protection to flag hacking or penetration testing tools. Turn on logging for all privileged utility usage. Enable command-line audit logging on servers and workstations. Switch on PowerShell script block logging and transcription. Log all sudo usage on Linux systems. Watch for unusual patterns - use outside normal hours or by unexpected accounts. Write a clear policy that spells out which utilities are approved, who can use them, under what circumstances, and what logging applies. Security and penetration testing tools should only be installed with explicit authorisation and a defined purpose. For utilities that must stay on systems, add compensating controls. Use just-in-time access for admin tools. Set application control rules that only allow execution from approved paths by approved users. Alert on anything that looks like credential dumping or network reconnaissance. Review the utility inventory regularly. Remove anything no longer needed and update your access controls as the landscape changes.