Study Guide
Least Privilege
Match permissions to authorised work, review changing access needs and limit the consequences of account compromise.
Lesson 1.5 Cybersecurity Foundations
Every account can do some things and not others. This lesson explains how those permissions should be decided, and why getting them right limits the harm a mistake or a compromised account can cause.
Stage: Think
Which key cards to hand out
A small hotel gives everyone an electronic key card. A guest is staying for two nights. A cleaner looks after the rooms on the second floor. The manager is responsible for the whole building.
Think it through
- Hint 1: Think about what happens when a card is lost.
Show the answer
Answer: A. A lost or stolen card would then open every room in the hotel.
Each card should open the doors its holder needs, and no more. Then a lost guest card exposes one room, not the whole building.
Think it through
Show the answer
Answer: B. No: the work needs those doors, and only those.
The aim is enough access for the work, and no more. Fewer doors would stop the cleaning, or tempt someone to borrow a card that opens everything.
Where the comparison stops. A key card does two jobs at once: it tells the door who you are, and it decides which doors open. A computer system keeps those apart. Signing in shows who you are; a separate decision says what you may do. That difference comes back later in this lesson.
The next step gives the idea you have just used its name.
Stage: Explain
The idea
Least privilege means granting users, processes and systems only the access necessary to perform their authorised functions. It applies to people’s accounts and equally to service accounts: accounts used by a program instead of a person, for example the account a backup program signs in with each night. Routine work should not automatically carry administrative permissions.
The aim is sufficient access for legitimate work without unnecessary authority, not the lowest possible permissions regardless of need. Removing required access can interrupt work or encourage unsafe workarounds; granting broad access for convenience creates avoidable exposure.
Check your understanding
Show the answer
Answer: C. Yes: its account needs only to read what it copies.
Least privilege applies to programs’ accounts as much as to people’s: the backup account needs to read files, not to administer the server.
Stage: Predict
Why it matters
Think it through
Show the answer
Answer: A. What the teacher’s account is allowed to do.
Read on: an attacker in an account can do whatever that account can do. Narrow permissions mean narrower harm.
If an attacker takes over an account, they can do whatever that account can do, and no more. Excessive access may expose information unrelated to the account holder’s duties or permit changes that ordinary work does not require. Restrictions can also reduce the effects of accidents and deliberate insider misuse.
Using a permission the account already has is not itself privilege escalation. An attacker may nevertheless seek additional credentials, exploit a vulnerability or exploit misconfiguration to gain greater authority. Least privilege narrows some opportunities; it does not guarantee that an attacker remains within the initial permissions. The existing Attack Chain explains that distinction without treating escalation as inevitable.
Stage: Predict
Example: standard and administrative accounts
Think it through
Show the answer
Answer: B. The malicious software may get the administrator’s full rights.
Malicious software usually runs with the rights of the account that opened it, so an administrator account turns one mistake into control of the system.
Use a standard user account for everyday work, reserving administrative access for tasks that need it. Administrative rights should not accompany ordinary browsing or document work merely because the person sometimes maintains systems.
This principle also explains why permissions need clear ownership and review. An access decision should identify the authorised task, necessary resources and permitted actions. An account’s job title alone does not establish that every permission assigned to it is appropriate.
Stage: Experiment
Worked example: staff access in a fictional school
Imagine a shared file server containing departmental teaching resources, administrative documents, payroll records and confidential pupil information. A teacher needs to use curriculum materials for their department. That does not automatically justify access to payroll, safeguarding records or the server’s administration functions.
Start with the work, not an unrestricted account
An information owner establishes what the teacher needs to read and which materials they may edit. Reading a document, changing its contents, deleting it and changing other people’s permissions are different capabilities. Access can be assigned through an appropriately defined role, with separate approval for any additional justified need.
Sensitive pupil information should be limited to those with the relevant responsibilities and a legitimate information need. Which roles need it differs from school to school; the decision follows the duties. An IT administrator may need elevated access for particular maintenance, but that authority need not be present in their routine account.
Successful sign-in does not grant every permission
Think it through
Show the answer
Answer: C. No: who they are does not decide what they may open.
Signing in establishes who someone is. What they may open is a separate decision, based on their work.
The teacher authenticates to the school’s service. That establishes or verifies the claimed identity for the sign-in; the service must still decide which resources and actions the account is authorised to use. A successful login can therefore allow access to departmental resources while denying access to payroll.
MFA strengthens authentication in suitable circumstances; it does not correct an overly broad authorisation policy. Conversely, a carefully restricted account still needs appropriate authentication. The two controls answer different questions and complement each other.
Compare the consequences of compromise
Suppose an attacker obtains the teacher’s credentials through phishing and succeeds in accessing the service. If the account can read every folder and alter server settings, the attacker may be able to reach unrelated records or make damaging changes. If the account is restricted to the teacher’s legitimate resources, the initial opportunity is narrower.
The permitted teaching resources are still at risk. A compromised account with editing rights may alter or delete documents within that scope. Do not conclude that a non-administrative account is harmless, or that limited initial access proves no other route exists. Appropriate monitoring, patching and response remain necessary. The CIA and DAD lessons explain how restricted access and modification can reduce confidentiality, integrity and, in some cases, availability consequences.
Check your understanding
Show the answer
Answer: A. The product descriptions it can still edit or delete.
The restriction keeps the rest of the shop’s systems out of immediate reach, but whatever the account may change is still at risk.
Stage: Predict
Applying and reviewing access
Role-based access control (RBAC) assigns permissions according to defined roles. It can make recurring access decisions consistent, but an over-broad role can consistently grant excessive access. Define roles from tasks, identify owners and review exceptions rather than assuming that using RBAC proves least privilege.
Separate privileged activity from ordinary work. Where supported and appropriate, just-in-time or time-limited privileged access can reduce how long elevated authority is available. Approval, scope, expiry and monitoring still matter; a short-lived excessive permission can cause harm while active.
Restrict service accounts to the systems, information and actions needed for their function. A backup program needs to read files; it does not need to create user accounts. An automated process is not automatically entitled to unrestricted administration. Include these accounts in ownership and review arrangements rather than focusing only on named employees.
Think it through
Show the answer
Answer: A. The account keeps science access it no longer needs.
Access that is only ever added builds up. The worked example below removes the old access and checks the result.
Review access periodically and when responsibilities change. In the fictional school, a teacher moving departments may need new resources and removal of old access. Adding the new role without considering the old one can accumulate permissions. Leaving the organisation should trigger prompt removal of access in line with the approved process.
A teacher in the fictional school moves from the science department to the humanities department.
- List current effective permissions. A person’s effective permissions are everything their account can actually do, added up from every source. Much of it is usually inherited: given to a group, such as “Science staff”, and passed on to each member. Include those and any one-off exceptions, not just what the teacher asked for originally. Suppose the account can edit science resources and read a shared staff folder.
- Compare them with the new duties. The teacher now needs humanities resources and the shared staff folder, but no longer needs to edit science materials.
- Authorise the change. The owner of the humanities resources approves the new access.
- Apply the change and remove old access. Grant humanities access and remove science editing rights. Adding the new role without removing the old one would accumulate permissions.
- Verify the result. Check the account’s effective permissions after the change, rather than relying on a completed request form.
A useful review compares actual permissions with current responsibilities, including inherited group access and exceptions. An owner confirms the need, changes are authorised and applied, and the result is checked. A record stating “review complete” is not proof that effective permissions are correct. Security Documentation develops the supporting approvals, procedures and evidence.
A supplementary summary of the steps developed in this lesson. The cycle repeats whenever responsibilities change.
- Identify the authorised work
Start with the task, not the job title or an existing account.
- Identify what it needs
Which information and which actions: read, edit, delete or change permissions?
- Approve
An accountable owner confirms the need.
- Assign
Grant access through a defined role, with separate approval for justified exceptions.
- Review
Check periodically and whenever responsibilities change, removing access that is no longer needed.
↺ Return to step 1, Identify the authorised work, and repeat.
These are implementation approaches to select according to context, not a requirement to deploy every mechanism in every organisation. Risk helps prioritise sensitive access and consequences. Security, Usability & Functionality explains why legitimate work and accessibility must remain part of the design.
A request for administrative rights is a good moment to apply least privilege. Ask which task needs the access, whether a standard account can do the everyday work, and whether elevated access can be limited to the task or time it is needed for.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Is there a way to meet the need without leaving extra rights on the everyday account?
Show the answer
Answer: C. Install it for them, or grant the rights only for that task.
Meet the legitimate need, but limit the elevated access to the task or the time it needs, rather than adding it to the everyday account.
Apply it
- Hint 1: Ask what the account can do, not what it is for.
Show the answer
Answer: B. Whatever an administrator can, such as create accounts.
An attacker gets the permissions the account has, not the ones its job needs. Restricting the account to reading files would have limited the harm.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: Use a standard account for everyday work.; Use administrative permissions only for tasks that need them.
Everyday work should use a standard account; administrative permissions are reserved for tasks requiring them. This reduces unnecessary access.
Revision sources: Session 2: Cyber Fundamentals Part 2 (Classroom session record) · Least Privilege (Supplementary Study Guide explanation)
Show answer
Answer: Authentication established identity; authorisation restricts the requested resource.
A valid identity does not imply access to every resource. Permissions should reflect authorised responsibilities and legitimate information needs.
Revision sources: Least Privilege (Supplementary Study Guide explanation)
Show answer
Answer: The initial scope is narrower, but those resources remain at risk and other attack paths need investigation.
Least privilege limits some consequences rather than eliminating them. Existing write permissions may still enable harmful changes; using them is not itself escalation.
Revision sources: Least Privilege (Supplementary Study Guide explanation)
Show answer
Answer: Compare actual and inherited permissions with current duties.; Obtain appropriate approval, apply necessary changes and check the effective result.
Reviews need to address effective access, ownership and implementation. Accumulated old permissions and paperwork without verification can leave excessive authority.
Revision sources: Least Privilege (Supplementary Study Guide explanation)
Show answer
Answer: A person requests a sensitive financial change and a different authorised person approves it.
Separation of duties divides sensitive responsibilities. Separate routine and administrative accounts can support least privilege but do not alone prevent one person completing the whole process.
Revision sources: Least Privilege (Supplementary Study Guide explanation)
Study and revision
Practise selected concepts through the topic overview, quiz and flashcards. Most of this revision is learning-only and is reached through the All topics track.
Stage: Consolidate
Revision takeaway
Ask: What must this account be able to do, what information does it need, who approves that access, and when should it be reviewed or removed? Then consider what harm those permissions could enable if the account were misused.
Least privilege is a preventative principle and a way to limit some consequences of compromise. It is not a substitute for the complementary controls in Defence in Depth, and it does not by itself protect a public service against distributed traffic exhaustion. The DDoS lesson addresses that different availability problem.
What to remember
- Give access from the work: enough for the authorised task, and no more.
- A stolen account can do whatever it is allowed to do, so narrow permissions mean narrower harm, though not none.
- Signing in shows who someone is; a separate decision says what they may do.
- Least privilege, need to know and separation of duties answer different questions.
- Review access when jobs change, removing what is no longer needed and checking the result.
Key terms
- Least privilege
Granting users, processes and systems only the access necessary to perform their authorised functions.
- Authentication
Establishing or verifying a claimed identity, for example when a user signs in.
- Authorisation
Deciding which resources and actions an identity is permitted to use.
- Need to know
The principle that a person should access particular information only where their role gives a legitimate requirement for it.
- Separation of duties
Dividing sensitive responsibilities so that one person cannot independently complete a whole sensitive process.
- Privilege escalation
Gaining greater permissions or access than originally held, for example through additional credentials, a vulnerability or a misconfiguration.
Common misunderstandings
It means enough access for legitimate work and no more. Removing required access can interrupt work or encourage unsafe workarounds.
Authentication establishes identity; authorisation decides what that identity may do. A successful sign-in does not grant every permission.
It can still read, alter or delete whatever it is permitted to. Least privilege narrows the harm; it does not remove it.
Separate standard and administrative accounts reduce exposure during routine work. Separation of duties requires sensitive responsibilities to be divided between different people or roles.
Lesson sources and acknowledgements
Sources and scope
Session 1 connected least privilege to interrupting an attack, and the approved Session 2 Learning Log recommended standard accounts for everyday use. The school scenario and distinctions in this lesson develop the supplied Session 2B educational reference, which is not a verbatim transcript. They do not describe a real school’s configuration, a completed access review or an implementation I performed. The access-decision diagram, the department-move example and the misunderstandings are supplementary explanations. Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the hotel key-card opening, every question asked in the lesson with its feedback and hints, the backup, hospital, shop, charity and finance examples and the summary under “What to remember” are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
Least privilege also appeared in the Session 7 review questions. Identity and Access Management: Identification and AAA places it within the wider access-control flow.
Designing systems so that people with different needs, devices and assistive technologies can use them. It is part of usable security, not a reason to remove required protection.
Establishing or verifying a claimed identity, for example when a user signs in.
The security objective of keeping systems, services and information accessible to authorised users when required.
The security objective of restricting information to authorised people, systems or processes.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
How far a system, service or piece of information can be seen or reached by others, especially from the internet.
The person accountable for a set of information, who decides its classification and who may access it.
The security objective of keeping information accurate and complete by protecting it from unauthorised or improper modification.
Granting users, processes and systems only the access necessary to perform their authorised functions.
Authentication that requires two or more different types of factor, such as something you know and something you have.
The principle that a person should access particular information only where their role gives a legitimate requirement for it.
Applying updates from a software vendor that fix known vulnerabilities or other flaws.
A deceptive message designed to trick the recipient into an action, such as revealing sign-in details or opening a malicious link.
A document that sets organisational rules and expectations, defining what is and is not permitted.
Gaining greater permissions or access than originally held, for example through additional credentials, a vulnerability or a misconfiguration.
Step-by-step instructions explaining how a particular task should be carried out.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
Dividing sensitive responsibilities so that one person cannot independently complete a whole sensitive process.
A computer, or a program running on one, whose job is to provide something to other computers: files, email, web pages or a database.
A weakness that a threat may exploit.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.