[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fac-6":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ac-6","AC-6","Least Privilege",914,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Users, and processes acting for them, should only have the access they need to do their assigned tasks, and nothing more.\n\n**In practice.** Doing this well means role-based access designed around real job functions, separate privileged accounts for administration, just-in-time elevation for admin rights, and removing local administrator rights from standard endpoints. Evidence includes role definitions, privileged access inventories, elevation logs and review results showing excess rights were removed. The idea appears in CIS Control 6 and in the ISO\u002FIEC 27001 controls on privileged access rights.\n\n**Common gaps.** Organisations often grant broad access to avoid friction and never take it back, so permissions accumulate over time. Cloud roles with wildcard permissions and service accounts with domain or tenant-wide rights are frequent weak points.","Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.\nDiscussion: Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"connectwise-supply-chain-attack-compromises-162-microsoft-365-tenants","ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants","2026-10-17T16:20:21.545+00:00",{"slug":25,"title":26,"published_at":27},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":29,"title":30,"published_at":31},"openbsd-root-exploit-chains-decades-old-bug-to-bypass-kernel-protections","OpenBSD Root Exploit Chains Decades-Old Bug to Bypass Kernel Protections","2026-10-16T20:20:45.22+00:00",{"slug":33,"title":34,"published_at":35},"phishing-smishing-attacks-target-election-officials-ahead-of-2026-midterms","Phishing & Smishing Attacks Target Election Officials Ahead of 2026 Midterms","2026-10-16T16:21:30.17+00:00",{"slug":37,"title":38,"published_at":39},"ai-model-misappropriates-third-party-crypto-funds-to-complete-task","AI Model Misappropriates Third-Party Crypto Funds to Complete Task","2026-10-16T16:20:58.749+00:00",{"slug":41,"title":42,"published_at":43},"ai-models-act-autonomously-to-bypass-auth-and-raid-crypto-wallets","AI Models Act Autonomously to Bypass Auth and Raid Crypto Wallets","2026-10-16T12:21:09.736+00:00",{"slug":45,"title":46,"published_at":47},"beyondtrust-zero-day-exploited-for-months-before-patch","BeyondTrust Zero-Day Exploited for Months Before Patch","2026-10-16T08:21:15.847+00:00",{"slug":49,"title":50,"published_at":51},"ai-agents-accessed-live-sensitive-data-during-testing-due-to-exposed-credentials-and-excessive-permi","AI Agents Accessed Live Sensitive Data During Testing Due to Exposed Credentials and Excessive Permissions","2026-10-16T08:20:59.754+00:00",{"slug":53,"title":54,"published_at":55},"malicious-aur-packages-execute-root-level-malware-via-typosquatting","Malicious AUR Packages Execute Root-Level Malware via Typosquatting","2026-10-15T18:20:20.988+00:00",{"slug":57,"title":58,"published_at":59},"cikabika-rat-abuses-discord-and-ngrok-to-evade-detection","CikaBika RAT Abuses Discord and Ngrok to Evade Detection","2026-10-15T12:20:40.147+00:00",{"slug":61,"title":62,"published_at":63},"langflow-rce-flaw-actively-exploited-via-unvalidated-command-injection","Langflow RCE Flaw Actively Exploited via Unvalidated Command Injection","2026-10-15T10:21:22.699+00:00",{"slug":65,"title":66,"published_at":67},"ghostaction-credential-theft-hits-1900-github-accounts-and-30000-repos","GhostAction Credential Theft Hits 1,900 GitHub Accounts and 30,000+ Repos","2026-10-15T10:20:51.258+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",339,{"slug":75,"name":76,"problem":77,"stories":78},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",224,{"slug":80,"name":81,"problem":82,"stories":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",222,{"slug":85,"name":86,"problem":87,"stories":88},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",218,{"slug":90,"name":91,"problem":92,"stories":93},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",160,{"slug":95,"name":96,"problem":97,"stories":98},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",158,[100,106,111,117,122,127,131,136],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","6","Control 6","Access Control Management",465,{"family":5,"item":107,"code":108,"title":109,"together":110},"ac-2","AC-2","Account Management",430,{"family":112,"item":113,"code":114,"title":115,"together":116},"gdpr","32","Article 32","Security of processing",395,{"family":101,"item":118,"code":119,"title":120,"together":121},"7","Control 7","Continuous Vulnerability Management",300,{"family":123,"item":124,"code":125,"title":125,"together":126},"itil","overview","ITIL",289,{"family":101,"item":128,"code":129,"title":109,"together":130},"5","Control 5",262,{"family":5,"item":132,"code":133,"title":134,"together":135},"si-2","SI-2","Flaw Remediation",251,{"family":101,"item":137,"code":138,"title":139,"together":140},"8","Control 8","Audit Log Management",236]