What is the principle of least privilege?
One of the most common cybersecurity mistakes we see is organizations not properly administering access across their networks — everyone gets access to everything, which leads to breaches that leak large amounts of data. Here's how to implement least privilege and reduce your attack surface.
What is the principle of least privilege?
The principle of least privilege is a methodology for granting access in information systems. Every user or application is given only the minimal access needed to do their job — and no more. Access is granted based on function rather than seniority.
Security access should be strictly controlled and granted only where there is an actual need. The CEO doesn't necessarily need access to every piece of data on the network — in fact, senior leaders should have as little access as possible, because executives are frequently targeted by attackers. Limiting their access means a compromised executive account still yields little of value.
Borrowing from the Zero Trust access-control criteria — where, what, who, when, how, why — answer as many of these as you can before granting access:
| Question | Explanation |
|---|---|
| What | Precisely what data or systems does the person need? What is the minimum access that still lets them do the job? |
| Where | Where is the data located? Do US employees need data on a German server? |
| Who | Which employee is it? Each person should use an individual account, never a shared one. |
| How | How will the data be accessed — FTP, SMB file share, an application? |
| When | When is access needed? Is VPN access only allowed during business hours? |
| Why | Why does this person need this particular data or system? |
Why limiting access matters
Limiting access reduces your attack surface, helps stop the spread of malware, improves productivity, and streamlines compliance and audits. Overall, it forces an attacker to work much harder to pivot through your environment.
Reducing attack surface
Most attacks begin with a foothold gained through an exploit or social engineering. Once inside, attackers look to pivot to an account with administrative privileges — usually an IT administrator.
Preventing the spread of malware
Malware spreads less easily when access is limited. When it tries to run under a standard account, it is prompted for administrative credentials — limiting its spread.
Streamlining compliance and audits
Most frameworks and regulations require least-privilege controls. HIPAA, for example, mandates that healthcare staff only access patient records when required for treatment. Limiting access up front reduces the work needed to comply.
Common access and privilege mistakes
We regularly exploit lapses in access control during penetration tests. A few places to enforce least privilege:
- Third-party access — limit and closely monitor the access vendors have to your systems and data.
- Local administrator rights — everyone, including IT staff, should work in standard accounts and only use admin accounts for admin tasks.
- Database users — applications and users should only reach the tables they need, with read-only access where writes aren't required.
- Old employees — IT and HR must coordinate so accounts are disabled promptly when people leave; periodic audits catch stale accounts.
- Shared accounts — every user should have a unique account, so actions can be attributed to a person.
Conclusion
When employees have more access than they need, attackers can pivot through your network quickly and exfiltrate sensitive information. A least-privilege model makes that exponentially harder — something we've seen first-hand on penetration tests.