A security principle that restricts access rights for accounts to the bare minimum permissions necessary to perform their tasks.
Description
The principle of Least Privilege (PoLP) is a fundamental concept in cybersecurity, particularly in managing Non-Human Identities (NHIs) such as service accounts, applications, and automated processes. It dictates that these identities should not have more permissions than required for their specific functions. This minimizes the attack surface and reduces the risk of exploitation by limiting what can be accessed or modified by these identities. For instance, if a service account only needs read access to a database, it should not be granted write access or administrative privileges. Implementing Least Privilege involves regularly reviewing permissions, using role-based access control (RBAC), and ensuring that any elevated privileges are temporary and logged. By adhering to this principle, organizations can enhance their security posture, mitigate risks of data breaches, and ensure compliance with regulatory requirements. Overall, the Least Privilege principle is crucial for maintaining a secure environment where NHIs operate with the minimum necessary permissions to reduce vulnerabilities.
Examples
- A service account that performs data backups is granted only read access to the database, not write or delete permissions.
- An application that generates reports has access only to the data it needs to read, without permissions to alter or delete any records.
Additional Information
- Regular audits should be conducted to ensure compliance with the Least Privilege principle.
- Automated tools can help manage and enforce permissions for NHIs effectively.
References
- Implementing Least Privilege at your Enterprise
- Managing Non-Human Identities for Vendor Access and Least Privilege Application Management Managing Non-Human Identities for Vendor Access and Least Privilege Application Management
- Microsoft Word - volume64_stoakley_master.doc
- What is Least Privilege, or the Principle of Least… | BeyondTrust
- What Is the Principle of Least Privilege and Why is it Important?
- Non-human Account Management (v4)
- Human vs. Non-Human Identity in SaaS
- Understanding and Deploying Least Privilege Security Models
- Attempted Murder of a Sacred Security Cow - Helen Patton - Medium
- Non-Human Access is the Path of Least Resistance: A 2023 Recap