Also known as: PoLP · least privilege access
The principle of least privilege holds that every user, process, and system should be granted only the minimum permissions necessary to perform its function, and no more.
Least privilege limits blast radius rather than preventing compromise. When a process running with narrow permissions is compromised, the attacker inherits only those narrow permissions — turning what could have been a total breach into a contained one.
The practical obstacle is that broad permissions are easier to grant than to scope correctly, and permissions accumulate over time as roles change. Regular access review and time-bound elevation are what keep the principle from eroding in practice.
Zero Trust
Zero trust is a security architecture that removes implicit trust based on network location, requiring every request to be authenticated, authorised, and continuously validated regardless of whether it originates inside or outside the corporate network.
Privilege Escalation
Privilege escalation is the act of exploiting a flaw or misconfiguration to gain a higher level of access than originally granted, such as moving from an unprivileged user account to administrator or root.
Defense in Depth
Defense in depth is a security strategy that layers multiple independent controls so that the failure or bypass of any single control does not result in compromise.
Microsegmentation
Microsegmentation is the practice of dividing a network into small isolated zones with explicit policies governing traffic between them, so that a compromised system cannot freely communicate with unrelated systems.