cybersecurity access-control

Least Privilege

least-privilege security principles
Plain English

Least privilege means handing out only the keys someone needs. An intern does not get the master key, and a web server does not run as root.

Technical Definition

The principle of least privilege limits damage from mistakes and compromise.

  • Daily work as a normal user; sudo only for specific commands.
  • Services run as dedicated users (www-data, a User= line in systemd).
  • Group-based folder access; mode 2770 not 777.
  • Bind services to loopback; firewall default deny.
  • Review and remove access when roles change.

Source: NIST SP 800-53 AC-6; CompTIA Security+ SY0-701 Exam Objectives v6.0

Least Privilege in practice 

# grant one command, not everything
%devteam ALL=(root) /usr/bin/systemctl restart nginx

$ sudo -l -U dev1
In the Wild

Least privilege runs through BNLC Phases 6 and 8. Security+ SY0-701 objectives 2.5 and 4.6 both name least privilege.

← Back to Dictionary