An HR employee has read access to the salary data of all staff — technically necessary for her role in payroll. One day she specifically searches through the salary data of executive management and of the new colleague she is having a conflict with. The access is technically permitted but out of purpose — a classic case of permission abuse.
Abuse of permissions (G 0.32) belongs to the insider threats that are especially hard to detect. The acting person has valid credentials, moves within the technically permitted limits and leaves log entries that appear unremarkable at first glance.
What’s behind it?
People are granted permissions to perform specific tasks. Abuse occurs when these options are deliberately used outside their intended scope — whether to obtain personal advantages, satisfy curiosity or cause harm to an organisation or person.
Enabling factors
- Historically grown rights (privilege creep) — In department changes, new rights are granted but old ones are not revoked. After several changes, a person has a multiple of the actually needed permissions.
- Lack of fine granularity — The coarser the authorisation model, the greater the scope for abuse. If “read access to all HR data” is granted instead of “read access to payroll data of the own organisational unit”, an unnecessary attack surface arises.
- Weak logging — When accesses are not logged, or not logged in an analysable way, there is neither deterrence nor the possibility to investigate.
- Lack of segregation of duties — When the same person can grant, use and control permissions, there is no checking authority.
Impact
The damage depends directly on the reach of the abused permissions. A clerk who views customer data without authorisation causes a limited confidentiality breach. An administrator who uses their root rights for data theft or sabotage can cause existential damage. In both cases, the organisation’s trust in its own access control is shaken.
Practical examples
IT administrator copies customer database. An administrator with full access to production databases regularly creates complete database exports — officially for backup purposes. In reality, he stores copies of the customer database on a private medium. The abuse is only discovered when he leaves the company and customer lists appear at a competitor.
Former project lead retains access rights. A project lead transfers to another department. His project rights — including access to confidential financial planning — are not revoked. Months later he accesses project documents irrelevant to his new role and shares information about upcoming budget cuts with colleagues on the project team.
Access rights in a shared application. A specialist application stores access rights in a system area that other users can also access. A technically skilled employee discovers this and changes his own permissions to access data actually reserved for executive management.
Relevant controls
The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 38 mapped controls below in the section ‘ISO 27001 Controls Covering This Threat’.)
Prevention:
- A.5.18 — Access rights: Formal process for granting, modifying and revoking — including recertification.
- A.8.3 — Information access restriction: Least privilege principle at the application level.
- A.5.3 — Segregation of duties: Separation of functions prevents a single person from controlling all steps of a critical process.
- A.6.6 — Confidentiality or non-disclosure agreements: Contractually anchored obligations to confidential handling of information.
- A.5.15 — Access control: Documented access control concept as the basis for all authorisation decisions.
Detection:
- A.8.15 — Logging: Detailed logging of all accesses, especially to sensitive data holdings.
- A.8.16 — Monitoring activities: User Behaviour Analytics detects access patterns that deviate from normal work behaviour.
Response:
- A.5.24 — Information security incident management planning and preparation: Procedures for handling insider incidents, including employment-law and forensic aspects.
- A.6.4 — Disciplinary process: Defined consequences for proven permission abuse.
BSI IT-Grundschutz
G 0.32 is linked by the BSI IT-Grundschutz catalogue to the following modules:
- ORP.4 (Identity and access management) — Requirements for fine-grained authorisation models and regular review.
- DER.2.3 (Remediation of far-reaching security incidents) — Procedures for handling insider attacks.
- ORP.2 (Personnel) — Personnel measures in case of abuse, including employment-law consequences.
- OPS.1.1.5 (Logging) — Requirements for the traceability of accesses.
Sources
- BSI: The State of IT Security in Germany — Annual report with findings on insider threats
- BSI IT-Grundschutz: Elementary Threats, G 0.32 — Original description of the elementary threat
- ISO/IEC 27002:2022 Section 5.18 — Implementation guidance on access rights