The principle of least privilege means giving users only the access they need to perform their duties. It reduces opportunities for accidental or malicious data breaches and limits the damage if a user’s credentials are compromised. section 7.1.2
A laptop user does not need administrator access
A person using an organizational laptop need not be an administrator merely to use it. With administrator authority, that person could install potentially malicious software. Removing unneeded authority protects the asset without preventing its intended use. section 6.2
Put the principle into practice as roles and business needs change:
- Define policies for who may access particular data and under what circumstances, considering roles and data sensitivity. section 7.1.7
- Choose access controls suited to those policies. Role-based and attribute-based access control can offer flexibility and precision in dynamic organizations. section 7.1.2
- Review permissions regularly and adjust them when responsibilities change; audit controls to check that access remains appropriate. section 7.1.7
Table 7.2 Unique features of different access controls models
| DAC |
MAC |
RBAC |
ABAC |
|
| Restrictiveness |
Low |
High |
Medium |
Medium |
| Control |
High |
Low |
Medium |
Medium |
| Flexibility |
Low |
Low |
High |
High |
| Policy maker |
Owner |
System |
Roles |
Attributes |
| Advantages |
Easy privilege configuration |
Highly secure |
Supports large enterprises Mitigates damage to data |
Automated trust negotiation Improves on RBAC |
| Disadvantages |
Low storage capacity Unauthorized privileges can be granted |
Low storage capacity Unable to modify security levels |
Privileges depend on role |
Requires investigation for defining attributes relevant to authorization decisions |
Compare access control models by restrictiveness, control, flexibility, and who sets policy before deciding how to enforce minimum necessary access. section 7.1.2
Least privilege also belongs in secure system configuration. Applying it to access controls alongside other hardening measures helps keep deployed software and underlying systems from relying on overly broad permissions. section 7.4.5
