Least Privilege.

What is least privilege?

NIST, citing CNSSI 4009 and SP 800-12, defines least privilege as a security principle that a system should restrict the access privileges of users, or processes acting for users, to the minimum necessary to accomplish assigned tasks. NIST SP 800-53 words it as a security architecture in which each entity is granted the minimum system resources and authorizations it needs to perform its function. OWASP puts it in plain terms: assign users only the minimum privileges necessary to complete their job.

How does least privilege work?

OWASP describes how to apply it to an application. In design, define trust boundaries, list the user types, the resources they can reach and the operations they need, then map which user types may do which operation on which resource. In development, write tests that check those permissions work as mapped. OWASP also says not to treat access as the default. One should be able to explicitly justify why a specific permission was granted. This is the idea of deny by default.

A simple illustration: a person who only reads reports gets read access to reports, not the ability to change settings or see payroll.

Why does it matter?

This is general reasoning rather than a claim from the sources. An account with narrow access can often expose less if it is misused or taken over. It can also mean an attacker who gains one account finds fewer doors open. Least privilege therefore supports other controls rather than replacing them.

How can you check and reduce excess access?

OWASP advises reviewing permissions regularly after launch, to find privilege creep. Privilege creep means current privileges have grown beyond what was originally intended. OWASP also notes that granting extra access later is simpler than taking back access already given, which is a reason to start narrow.

• List who has access to what.
• Justify every permission that was granted.
• Review the list on a regular schedule and remove what is no longer needed.

Is least privilege the same as zero trust?

No. Least privilege is a single principle about how much access an identity gets. Zero trust is a wider security approach. The two fit together, since limited access is useful under any model, but this page does not claim a source ties them as one.

Is least privilege the same as privilege escalation?

No. They are opposites in effect. Least privilege keeps access small. Privilege escalation is an attacker gaining higher permissions than they started with.

Related terms

See also zero trust, non-human identity and insider threat.

Related pages in the Knowledge Hub

• Exploitation for Privilege Escalation

Sources

• NIST: NIST glossary definitions of least privilege from CNSSI 4009, SP 800-12 and SP 800-53.
• OWASP: OWASP describes least privilege, deny by default, justifying permissions and reviewing for privilege creep.