Least privilege is one of the oldest and at the same time most effective principles of information security. The idea: the fewer rights an account has, the less damage can occur if it is misused, taken over or accidentally operated incorrectly. The principle is a central component of zero trust and also plays an important role in access control in management systems based on ISO/IEC 27001.
In practice, permissions often grow over the years: employees change departments and keep old access, project folders remain open to everyone, and user accounts have local administrator rights because a piece of software once required it. Least privilege counteracts this creeping growth.
How is least privilege implemented?
The principle applies at several levels:
- Role-based rights: Permissions are tied to roles such as accounting or sales, not assigned individually.
- Separate accounts: Administrators use a dedicated account for administrative tasks and work with a normal user account in everyday work.
- Time-limited rights: Elevated rights are granted only when needed and for a limited time, often called just-in-time access.
- Service accounts: Programs, interfaces and automations also receive only the rights they really need.
- Regular review: Permissions are checked and cleaned up at fixed intervals.
Typical examples
- Employees work without local administrator rights, and software is distributed centrally.
- Interns receive access to their team's project folder, not to the entire drive.
- An app that evaluates calendar data does not get permission to read all mailboxes.
- When someone moves to another department, old access is revoked, see IT onboarding and offboarding.
What companies should keep in mind
- Start with the biggest risks: administrator accounts, remote access and particularly sensitive data.
- Assign rights via groups and roles, not directly to individuals.
- Plan regular recertifications in which managers confirm the rights of their team.
- Additionally secure highly privileged access with privileged access management.
- Pay attention to usability so that employees do not look for workarounds.
How it differs
The need-to-know principle is closely related: it restricts access to information to those who need to know it for their task. Least privilege is broader and concerns all rights, including technical ones such as installing software, managing accounts or changing configurations.
View security services