Access Management and the Principle of Least Privilege

In a well-run building, not everyone has a key to every room: the receptionist cannot enter the server room and the cleaner does not open the safe. The same idea applies to digital systems, and it is called the principle of least privilege. In this lesson you will learn what it means from a user's point of view, why it limits the damage of every kind of attack, and how to apply it in your own work.

In the previous lessons you saw that attackers often enter through an ordinary employee's account. What they can do next depends on what that account is allowed to do. Limiting access is how organizations make sure that one stolen login does not mean total disaster.

Three words: identity, authentication, authorization

Access control rests on three ideas that are easy to mix up:

• Identification: claiming who you are (your username).
• Authentication: proving it (password, second factor, passkey), as we covered in Chapter 2.
• Authorization: deciding what you are allowed to do once you are identified (which files you can open, which actions you can perform).

Strong authentication is useless if authorization is too generous. Imagine a very secure front door that opens onto a building where every room is unlocked.

The principle of least privilege

The principle of least privilege says that every person, account and program should have only the access it needs to do its job, and nothing more, for only as long as it is needed.

Consider Léa, who works in the marketing department. She needs access to the shared marketing folder and the social media tools. She does not need access to the payroll folder or the customer database export. If her account is stolen by phishing, the attacker can reach only marketing resources. If she had broad access "just in case", the same phishing email would give the attacker the whole company.

Least privilege therefore delivers three advantages:

• It limits the damage of a compromised account, an infected computer or a mistake.
• It reduces insider risk, whether malicious or accidental, such as someone deleting a folder they should never have been able to modify.
• It makes problems easier to trace, since fewer people have access to each resource.

Related principles

• Need to know: access to sensitive information is limited to those who need it for their work, even if their role would technically allow more.
• Separation of duties: critical actions require more than one person. For example, one person prepares a payment and another approves it. This is a strong defense against fraud, including the fake-invoice scams of lesson 1.3.
• Role-based access: rights are assigned to roles ("accountant", "sales manager") rather than to individuals, which makes them easier to manage and review.
• Defense in depth: access control is one layer among several.

Administrator and standard accounts

The most privileged accounts are administrator accounts, which can install software, change settings, create users and see almost everything. If one is compromised, the attacker controls the system. That is why good practice is:

• Use a standard account for daily work, such as email, browsing and documents. Use an administrator account only when a task requires it.
• If you have administrator rights in your job, keep a separate account for administrative tasks, with a stronger authentication method.
• Never share administrator accounts, and never use them to browse the web or read email.
• The same logic applies at home: do not use an administrator account for everyday activities on your personal computer, as we noted in lesson 3.1.

What you can do as a user

You are not an administrator, but you have an important part to play in keeping access tidy.

1. Never share your credentials. Sharing your login with a colleague, even a trusted one, makes actions untraceable and violates most policies. Request the right access for them instead.
2. Request access through the official process and justify it. Be specific about what is needed and why, and for how long if it is temporary.
3. Do not accept more access than you need. If you are given permissions that seem excessive, tell the IT team. It may be a mistake, and mistakes of that kind are how data leaks begin.
4. Release access you no longer need. When you change roles or finish a project, ask for the removal of permissions you do not need anymore. This avoids the slow build-up of rights known as privilege creep.
5. Be careful with sharing links. When you share a document, choose named people rather than "anyone with the link", and use view-only permission when editing is not needed. Review old shared links regularly.
6. Mind shared mailboxes and shared folders. Know who else can see them.
7. Lock your session when you leave, so that your access cannot be used by someone else.
8. Watch for unusual access. If you notice that you can see data you should not, or that your access suddenly changed, report it.

Departures and onboarding

Access management is especially critical when people join, move or leave:

• New employees should receive only the access of their role, from the start, not a copy of a colleague's full permissions.
• People who change role should lose the rights of their previous role.
• People who leave must have all accounts, tokens, devices and shared access removed promptly. Forgotten accounts of former employees are a well-known risk. If you manage a team, make sure the checklist is followed.
• Temporary workers and external partners should have time-limited access and the lowest rights necessary.

Least privilege at home

The principle is not limited to companies. In your personal digital life you can apply it too:

• Give apps only the permissions they need (lesson 3.4).
• Use a standard user account on your computer, and separate accounts for each family member.
• Share documents only with the people who need them, and remove access afterwards.
• Do not give a family member or a repair person the full password of an important account when a limited-access option exists.
• Review connected apps and delete the ones you no longer use (lesson 5.3).

The tension with productivity

Strict access can feel like an obstacle when you urgently need a file. Organizations should make requests quick and simple, so that people do not seek workarounds. If the access process is painfully slow, tell your manager or the IT team, because slow processes are a security risk when they lead people to share passwords or to use unapproved tools.

Your turn

Exercise. A new intern joins the sales team on Monday. The manager says: "Just give her the same access as Paul, so she can start immediately." Paul is a senior salesperson with access to the customer database, pricing tools, the finance reports and the administration panel. What would you propose?

See a solution

1. Explain that copying a colleague's permissions gives the intern far more than needed (finance reports and the admin panel, for example), which violates least privilege.
2. Ask the IT team for a role-based profile for an intern in sales, with access limited to what the first tasks require: the shared sales folder, the basic CRM view and the communication tools.
3. Define a review date: after a few weeks, add what is needed, and remove nothing silently.
4. If the manager worries about delay, request an urgent, correctly scoped set of access, rather than a copy of Paul's account.
5. Ensure that the intern has her own account with two-factor authentication, never a shared login.

Add to your Security Notebook

Under "6. Security at work", write the list of systems and shared folders you have access to, mark the ones you no longer need, and write down one request to make to your IT team to remove them. Add a rule for yourself: "I never share my login."

Even with the best habits, incidents happen. The final lesson of this chapter is about what to do, and whom to tell, when something goes wrong at work.