THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · AC-6

Least Privilege

US National Institute of Standards and Technology (NIST) · cited in 914 of our lessons

Explanation

What it asks for. Users, and processes acting for them, should only have the access they need to do their assigned tasks, and nothing more.

In practice. Doing this well means role-based access designed around real job functions, separate privileged accounts for administration, just-in-time elevation for admin rights, and removing local administrator rights from standard endpoints. Evidence includes role definitions, privileged access inventories, elevation logs and review results showing excess rights were removed. The idea appears in CIS Control 6 and in the ISO/IEC 27001 controls on privileged access rights.

Common gaps. Organisations often grant broad access to avoid friction and never take it back, so permissions accumulate over time. Cloud roles with wildcard permissions and service accounts with domain or tenant-wide rights are frequent weak points.

Open SP 800-53 at NIST
The official text
Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks. Discussion: Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 914.