Cybersecurity Beyond the Basics: The Principle of Least Privilege

With a Zero Trust strategy for cybersecurity, the presence of an intruder is assumed. That means that tactics are needed to limit exposure and the potential damage that the intruder can do. One of those tactics is the Principle of Least Privilege.

Least privilege involves matching up permissions to access data with the job or tasks that need to be done. This starts with determining exactly what data is needed to perform specific functions and then establishing limits.

Historically, companies have been quite relaxed when it comes to allocating permissions with user and even administrator accounts because opening up access is sometimes the easiest way to get things to work. However, when an account that has the power to make system-wide changes is compromised, the potential for damage resulting from a cyber intrusion is a lot greater.

Applying The Principle of Least Privilege

Here are some examples of what the Principle of Least Privilege looks like in practical terms:

Managers can get to the employee information that’s pertinent to them, but they can’t see employee records that have to do with payroll and benefits.
Quality assurance inspectors have access to the specs of the component that’s being manufactured, but not to blueprints detailing the entire assembly that it’s a part of.
Accounting clerks can pay bills and post payments, but they don’t have access to all of the corporate financial information.
Shared file access is controlled and users have no more permissions than they need, from Read-Only to edit.

There are other scenarios that aren’t necessarily tied to a job role where the Principle of Least Privilege should be applied such as:

Users should not have local administrator privileges for their computers.
Service accounts should be used instead of domain accounts for server functions.
Privileged accounts should only be used for administrative tasks.

Privileged Accounts Targeted by Hackers

A “Privileged Account” has ultimate power when it comes to making changes inside of your network so naturally, these are top targets for cyber criminals.

Forrester Research estimates that 80% of security breaches involve privileged accounts. Privileged accounts provide elevated access to all of the other accounts in the domain, as well as applications and systems. In the wrong hands, they have the ability to take over an entire IT system, not to mention steal, corrupt or expose data that’s stored there.

Privileged accounts should be used exclusively for administrative tasks, and users should have a different account for their other job functions and communications. It might seem inconvenient to have more than one account to log in and out of but to a hacker, capturing a privileged account is like stealing the keys to the castle. Not only will they be able to move about inside the castle, but they’ll be able to control all the inhabitants and steal the jewels inside too.

Maintaining Least Privilege

While technical controls are used as one of the tactics to limit data access at the application or system level, you also need documented policies so that the people controlling permissions know exactly what is and isn’t allowed.

Data access guidelines should be included in employee training. Employees need to know not just what data they need, but how they should handle situations like – what should they do when a vendor asks for access to IT systems; what should happen when an employee is terminated; or what should they do if someone asks to use their account credentials.

Moving Towards a Zero Trust Cybersecurity Strategy

Zero Trust is a cybersecurity strategy promoted by a May 2021 Executive Order of the White House. While you may not be responsible for the security of critical infrastructure, every organization that does business on the internet needs to play a part in thwarting cyber-criminals.

Related: What is Zero Trust?

Do You Have Security Gaps?

It can be difficult to know if you have gaps in security that are increasing your exposure to cyber risk. That’s why a cyber assessment is the best next step in strengthening your security posture. You’ll get the recommendations you need to develop a cybersecurity plan that will allow you to build cyber resilience.