The principle of least privilege

The principle of least privilege says that a user, application or device should only be able to reach the data and actions it needs to do its job. The principle is simple; applying it is often neglected because of permissions accumulated over the years.

How permissions pile up

When an employee moves to another project, new access is granted but the old access is not removed. Administrator rights given temporarily for an urgent task become permanent. Shared folders are left open to “everyone”. A few years later, nobody can explain who has access to what, or why.

This build-up creates two risks: an accidental deletion or change has a larger impact, and a single compromised account gives an attacker far more reach than necessary.

Role-based access

The most practical way to apply the principle is to tie permissions to roles rather than people. First define the roles in the organisation, such as finance, sales, field team and management. Decide which folders, applications and actions each role can reach. When a user joins a role, the permissions come automatically; when they leave it, the permissions go automatically.

Separate administrator accounts

The account used for everyday work and the account used for administration should be separate. If the account used to read email and browse the web is also an administrator on every system, a single wrong click can do much more damage. Keep administrator accounts few and protect them with the strongest authentication method.

Application and system accounts

Least privilege applies to systems as well as people. An integration that only needs to read data should not have write access. The credentials of a backup tool should not be the same as those that manage production systems.

Regular reviews

Access is not set up once and left alone. At regular intervals, check:

• Have all accounts of people who left been closed?
• Have old permissions of people who changed roles been removed?
• Are there folders or sharing links left open to everyone?
• Is the list of accounts with administrator rights current and justified?

Balancing usability

Least privilege should not mean making work harder. When it is clear how to request access, who approves it and how long it takes, users see restrictions as part of an orderly setup rather than an obstacle.