NIST-AC-5 Separation of Duties

a. Identify and document [Assignment: duties of individuals] ; and b. Define system access authorizations to support separation of duties.

Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. Separation of duties includes dividing mission or business functions and support functions among different individuals or roles, conducting system support functions with different individuals, and ensuring that security personnel who administer access control functions do not also administer audit functions. Because separation of duty violations can span systems and application domains, organizations consider the entirety of systems and system components when developing policy on separation of duties. Separation of duties is enforced through the account management activities in [AC-2](#ac-2) , access control mechanisms in [AC-3](#ac-3) , and identity management activities in [IA-2](#ia-2), [IA-4](#ia-4) , and [IA-12](#ia-12).

• T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.002 Security Account Manager • T1003.003 NTDS • T1003.004 LSA Secrets • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1003.007 Proc Filesystem • T1003.008 /etc/passwd and /etc/shadow • T1021 Remote Services • T1021.001 Remote Desktop Protocol • T1021.002 SMB/Windows Admin Shares • T1021.003 Distributed Component Object Model • T1021.004 SSH • T1021.006 Windows Remote Management • T1021.007 Cloud Services • T1047 Windows Management Instrumentation • T1053 Scheduled Task/Job • T1053.002 At • T1053.003 Cron • T1053.005 Scheduled Task • T1053.006 Systemd Timers • T1053.007 Container Orchestration Job • T1055 Process Injection • T1055.008 Ptrace System Calls • T1056.003 Web Portal Capture • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.008 Network Device CLI • T1070 Indicator Removal • T1070.001 Clear Windows Event Logs • T1070.002 Clear Linux or Mac System Logs • T1070.003 Clear Command History • T1070.007 Clear Network Connection History and Configurations • T1070.008 Clear Mailbox Data • T1070.009 Clear Persistence • T1072 Software Deployment Tools • T1078 Valid Accounts • T1078.001 Default Accounts • T1078.002 Domain Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts • T1087.004 Cloud Account • T1098 Account Manipulation • T1098.001 Additional Cloud Credentials • T1098.002 Additional Email Delegate Permissions • T1098.003 Additional Cloud Roles • T1098.004 SSH Authorized Keys • T1098.005 Device Registration • T1098.007 Additional Local or Domain Groups • T1110 Brute Force • T1110.001 Password Guessing • T1110.002 Password Cracking • T1110.003 Password Spraying • T1110.004 Credential Stuffing • T1134 Access Token Manipulation • T1134.001 Token Impersonation/Theft • T1134.002 Create Process with Token • T1134.003 Make and Impersonate Token • T1134.005 SID-History Injection • T1136 Create Account • T1136.001 Local Account • T1136.002 Domain Account • T1136.003 Cloud Account • T1185 Browser Session Hijacking • T1190 Exploit Public-Facing Application • T1197 BITS Jobs • T1210 Exploitation of Remote Services • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.003 Code Repositories • T1213.004 Customer Relationship Management Software • T1218 System Binary Proxy Execution • T1218.007 Msiexec • T1222 File and Directory Permissions Modification • T1222.001 Windows File and Directory Permissions Modification • T1222.002 Linux and Mac File and Directory Permissions Modification • T1484 Domain or Tenant Policy Modification • T1489 Service Stop • T1495 Firmware Corruption • T1505 Server Software Component • T1505.002 Transport Agent • T1505.003 Web Shell • T1505.005 Terminal Services DLL • T1525 Implant Internal Image • T1528 Steal Application Access Token • T1530 Data from Cloud Storage • T1537 Transfer Data to Cloud Account • T1538 Cloud Service Dashboard • T1542 Pre-OS Boot • T1542.001 System Firmware • T1542.003 Bootkit • T1542.005 TFTP Boot • T1543 Create or Modify System Process • T1543.001 Launch Agent • T1543.002 Systemd Service • T1543.003 Windows Service • T1543.004 Launch Daemon • T1543.005 Container Service • T1546.003 Windows Management Instrumentation Event Subscription • T1547.004 Winlogon Helper DLL • T1547.006 Kernel Modules and Extensions • T1547.009 Shortcut Modification • T1547.012 Print Processors • T1547.013 XDG Autostart Entries • T1548 Abuse Elevation Control Mechanism • T1548.002 Bypass User Account Control • T1548.003 Sudo and Sudo Caching • T1548.006 TCC Manipulation • T1550 Use Alternate Authentication Material • T1550.002 Pass the Hash • T1550.003 Pass the Ticket • T1552 Unsecured Credentials • T1552.001 Credentials In Files • T1552.002 Credentials in Registry • T1552.006 Group Policy Preferences • T1552.007 Container API • T1556 Modify Authentication Process • T1556.001 Domain Controller Authentication • T1556.003 Pluggable Authentication Modules • T1556.004 Network Device Authentication • T1556.005 Reversible Encryption • T1556.009 Conditional Access Policies • T1558 Steal or Forge Kerberos Tickets • T1558.001 Golden Ticket • T1558.002 Silver Ticket • T1558.003 Kerberoasting • T1559 Inter-Process Communication • T1559.001 Component Object Model • T1562 Impair Defenses • T1562.001 Disable or Modify Tools • T1562.002 Disable Windows Event Logging • T1562.004 Disable or Modify System Firewall • T1562.006 Indicator Blocking • T1562.007 Disable or Modify Cloud Firewall • T1562.008 Disable or Modify Cloud Logs • T1562.009 Safe Mode Boot • T1563 Remote Service Session Hijacking • T1563.001 SSH Hijacking • T1563.002 RDP Hijacking • T1569 System Services • T1569.001 Launchctl • T1569.002 Service Execution • T1574 Hijack Execution Flow • T1574.004 Dylib Hijacking • T1574.005 Executable Installer File Permissions Weakness • T1574.007 Path Interception by PATH Environment Variable • T1574.008 Path Interception by Search Order Hijacking • T1574.009 Path Interception by Unquoted Path … and 17 more