The principle of least privilege (or PoLP) is, in layman’s terms, the idea that a user or technological process should have the minimum IT access necessary to efficiently complete their job or tasks. In other words, does Joe from Marketing need access to records from HR to perform his duty? If not, he should not be able to access them. Does Margaret from Accounting need access to the Finance records? Likely so, so she should have access to them. But poor Joe in Marketing might be cut off again.
Poor Joe, relegated to his Marketing cubicle without access to HR or Finance. Why don’t we like Joe? I mean, he’s a nice guy, does his job well, and has always passed his phishing tests. He follows his MSP’s advice and uses a high–quality password. He logs out every time he leaves work and even locks his computer on coffee breaks. He’s even pretty good at his job.
Sorry, Joe. The principle of least access is at work here. And for good reason! While Joe may follow all the rules and do everything perfectly, he is not impervious to attack. We’re not always interested in simply keeping Joe out of the Finance records, but rather keeping online attackers limited, should they gain access.
Least privilege principles and policies work in a few similar but non-identical ways. While certainly not an exhaustive list, some examples include:
- By limiting an application, or even a process within an application, including malware, to certain areas (also called surfaces or “attack” surfaces)
- By limiting a user to certain areas, thus decreasing the amount of damage a bad actor or disgruntled employee can incur
- By limiting the area humans can make an error, for example an accidental deletion or inadvertent file edit
- By removing the ability to granting admin access to users who don’t need it
- By separating privileges, especially at the admin level, to require two sets of credentials to perform especially potentially destructive tasks
- By requiring periodic audits to ensure PoLP principles are being followed
Remember Joe? Unfortunately for him (and his company), Joe was a fan of the online fictitious outdoor store, ABC Camping. ABC Camping’s database was hacked, and Joe’s excellent complex password happened to be the same as his work password. When that information was offered for sale on the Dark Web, and because Joe’s company wasn’t monitoring the Dark Web for his personal email, it took just a tiny bit of social engineering to uncover Joe’s username at work. Luckily for all involved, while a small bit of marketing materials were compromised to due to the hack, many other areas of the company’s information was out of the reach of Joe’s account…and Joe’s impersonator.
Like other layers of the cybersecurity shield, the principle of least privilege isn’t a one-stop for cyberdefense. However, it is an important layer and additional obstacle for bad actors. Not sure where your company stands? We can help you with your PoLP policies (as well as help monitor the Dark Web for you). Give us a call or click on our contact form!
