Practically? In most environments interpret this to include:
- Windows programs that run as administrator
- UNIX software with setuid or similar privileges (that includes su and sudo themselves which are setuid).
Is this intended to be a policy around setting access permissions for utilities?
That's one way of achieving the goals.
What policies do other organisations have in this area?
I've start with only letting system admins access to server operating systems and therefore only allowing them to use system utilities of any kind (this should implement ISO27002:2013, 9.4.4i, b and c). This is getting easier as more and more applications are delivered via HTTP.
Then system hardening including removing unnecessary utilities would be a good second priority activity.
What was it actually supposed to mean?
I've asked this question to at least ten external auditors and not received a consistent answer.
One or two have suggested that it made more sense in the days of certain mainframe operating systems, but I've not seen much primary evidence for this. The only reference was:
This is for a http://en.wikipedia.org/wiki/RSX-11 system and the manual page is dated 1991.
And you could easily argue that all programs on well designed systems (other than exploits) cannot 'override system security controls'. They may make use of enhanced privileges permitted by the operating system, but certainly don't override the controls.