This is not practical for all access, but sensitive access that is task-centric should be time-bound or contextually provisioned. Achieving contextual and timely access reviews necessitates investments in automation and several other best practices. upon a significant role change) and occur on a more frequent and timely basis (sorry, no more yearly access reviews). To achieve this goal, access reviews should be more contextual (e.g. They should become a critical tool for your company to remove unnecessary access on a regular basis. Access reviews should not always just be conducted simply to meet compliance requirements. Who has access to what, what roles and permissions exist, the relationship of access and entitlements, and so on are all critical questions that security needs to be able to answer in order to focus their efforts and achieve least privilege.Ĭonduct timely, contextual access reviewsĪccess reviews help to attenuate access and permissions that are no longer needed. The basis of securing any environment is to understand what is going on in the environment.

To truly achieve least privilege access, you need to implement a handful of practices: What are the critical elements to achieving least privilege access?

They help drive a baseline discussion for companies to ensure that they have some minimal set of access control best practices in place. As we all know, there is not always a perfect overlap between compliance and security, but the intention is good with these compliance regimes. Almost every security-centric compliance framework mandates some level of controls and policies over identity and access management and typically references least privilege access control as an essential element of said program. If you have your SOC 2 certification, handle credit cards and deal with PCI, are in healthcare, or are a public company, then you also care about least privilege because you have to, from a regulatory standpoint. Reducing the standing footprint of unnecessary permissions and access that identities have is critical to reducing the potential risk of compromise. In this world, what an identity is allowed to do is the blast radius that the identity has to cause damage to your organization in the case of compromise. Lateral movement is simply federating across applications boundaries or logging in with a local account in an environment. Least privilege for the modern workforceĪs more and more identities move to the cloud, the threat to companies will be less about compromising machines and moving laterally on a network, and more about compromising identities and moving laterally in the cloud. Operating on least privilege access allows companies to reduce the attack surface area of compromised identities and insider threats. At the highest level, think of least privilege access as providing people – or identities more generally – the access they need to do a job, and for no longer than they need it. As one of the core tenants of zero trust, least privilege access is probably the least understood and the hardest to reach today.

Least privilege access control