Question

What security principle dictates that a user should only be granted the minimum level of access required to complete their specific business function?

Accepted Answer

The security principle that dictates a user should only be granted the minimum level of access required to complete their specific business function is known as the Principle of Least Privilege. This concept requires that every module, process, or user account be restricted to only the information and resources necessary for its legitimate purpose. By limiting access rights to the bare minimum, organizations reduce the attack surface, which is the total sum of all points where an unauthorized user can try to enter data or extract data. If a user account is compromised, the damage is restricted to the limited scope of that user&#x27;s permissions, preventing the attacker from moving laterally throughout the rest of the system. An example of this is a customer service representative who only has read and write access to customer account details but is denied administrative access to the underlying server files or database configurations. This practice ensures that if the representative&#x27;s credentials are stolen, the attacker cannot delete the entire database or change system settings because the account lacks those specific permissions.

Home → All Courses → Engineering and Technology Courses → Zero Trust Security Architecture → Flashcard

What security principle dictates that a user should only be granted the minimum level of access required to complete their specific business function?