Least Privilege

Lesson plan

Level

Beginner

Time

About 65 minutes; the steps below add up to 64

The original lesson, kept word for word, opens with the formal definition; the guided version first asks learners to hand out hotel key cards, so the principle (enough for the job, no more) comes from them and the definition then names it. The key-card comparison is stopped deliberately: a card both identifies and permits, which sets up the later separation of signing in from permission. Predictions precede each point where beginners go wrong: what a stolen account can do, an administrator account used for email, a successful sign-in taken as permission, and access that is only ever added. The habit to build: start from the work, then ask what harm the permissions could enable.

Objectives

• Decide what access a person, program or system needs from the work it does
• Explain why limiting access limits the harm a stolen account or a mistake can cause
• Tell signing in (authentication) apart from what an account may do (authorisation)
• Tell least privilege apart from need to know and separation of duties
• Review access when someone’s job changes, removing what is no longer needed

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the CIA Triad lesson first.
• Draw three key cards on the board, for the guest, the cleaner and the manager, and leave space to list the doors each opens.
• The lesson takes about 64 minutes. To teach it in two parts, stop after “Worked example: staff access in a fictional school”; the second part opens with “Related ideas, different purposes”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Decide what access a person, program or system needs from the work it does
   • Explain why limiting access limits the harm a stolen account or a mistake can cause
   • Tell signing in (authentication) apart from what an account may do (authorisation)
   • Tell least privilege apart from need to know and separation of duties
   • Review access when someone’s job changes, removing what is no longer needed

   Purpose: The original lesson, kept word for word, opens with the formal definition; the guided version first asks learners to hand out hotel key cards, so the principle (enough for the job, no more) comes from them and the definition then names it. The key-card comparison is stopped deliberately: a card both identifies and permits, which sets up the later separation of signing in from permission. Predictions precede each point where beginners go wrong: what a stolen account can do, an administrator account used for email, a successful sign-in taken as permission, and access that is only ever added. The habit to build: start from the work, then ask what harm the permissions could enable.

2. 1. Which key cards to hand out Think 7 min

   Purpose: Find the principle from a familiar situation before any term is used, and see where the comparison stops.

   Ask

   • Which doors should each card open?
   • Why not one card that opens everything?
   • Is the cleaner's floor-wide card too much?

   Responses to expect

   • Most say the master card is “convenient but risky”; press for what a single lost card would expose.
   • Some say the cleaner should have as few doors as possible. Ask how the rooms would then be cleaned.
   • On screen in turns: the opening question, its answer; then the question on the cleaner’s card, and its answer; where the key-card comparison stops.

   Misconceptions to challenge

   • A learner may believe: “The fewer doors the better, whatever the job.” Respond: Too few stops the work and tempts people to borrow broader cards.

   Discussion pause: Collect the lists of doors before revealing either answer.

   In the lesson window

   • Think it through: A new receptionist suggests giving everyone a card that opens every door, so that nobody is ever locked out. What is the strongest objection?
   • Think it through: The cleaner’s card opens every room on the second floor during working hours. Is that too much?

3. 2. The idea Explain 5 min

   Purpose: Name the principle, and extend it to programs' accounts.

   Ask

   • Does the backup program's account need the same care as a person's?

   Responses to expect

   • Many forget programs have accounts. Ask what a thief could do with the backup account's password.
   • On screen in turns: the opening; then why the aim is enough access, not the least possible; the check question on the backup program’s account, and its answer.

   If the explanation does not land: Compare a supply teacher’s access: enough to teach the class and use its room, not the head’s office or the payroll system.

   In the lesson window

   • Check your understanding: A backup program signs in every night to copy the files on a server. Does least privilege apply to its account?

4. 3. Why it matters Predict 5 min

   Purpose: Connect permissions to the harm a compromised account can cause, and separate using a permission from escalating.

   Ask

   • A teacher's password is stolen. What decides the harm in the first minute?

   Responses to expect

   • “How good the hacker is” is common; return to what the account itself can do.
   • On screen in turns: the opening question, its answer; then what an attacker inherits from an account; why using a permission already held is not escalation.

   Discussion pause: Ask the class: if your own school or work account were stolen tonight, what could someone do with it by morning?

   In the lesson window

   • Think it through: An attacker steals a teacher’s password and signs in. What decides how much harm they can do straight away?

5. 4. Example: standard and administrative accounts Predict 5 min

   Purpose: Show why everyday work belongs on a standard account.

   Ask

   • Same attachment, administrator account or standard account: what changes?

   Responses to expect

   • Some think administrators are better protected. The software runs with the opener's rights.
   • On screen in turns: the opening question, its answer; then the everyday rule: a standard account; why permissions need an owner and a review.

   Misconceptions to challenge

   • A learner may believe: “Administrators should always work as administrators.” Respond: Most of their day is email and documents. The administrator account is needed for a few tasks, so it is used only for those.

   In the lesson window

   • Think it through: An IT technician reads email while signed in with an administrator account, and opens a malicious attachment. What is different from opening it on a standard account?

6. 5. Worked example: staff access in a fictional school Experiment 12 min

   Purpose: Work through deciding a teacher's access, separating signing in from permission, and comparing the harm from a broad and a narrow account.

   Ask

   • The receptionist signed in correctly. Should test results open?
   • A limited account is phished. What is still at risk?

   Responses to expect

   • “Yes, they are staff” comes up; ask what their job needs to see.
   • “Nothing” is common for a non-administrator account; insist on what it may change.
   • On screen in turns: the opening; then starting from the work, not an unrestricted account; the question on the signed-in receptionist, and its answer; why signing in and permission are separate decisions; the consequences of a compromise, compared; the check question on the shop assistant’s account, and its answer.

   Misconceptions to challenge

   • A learner may believe: “If someone can sign in, they should be able to see everything.” Respond: Signing in settles identity. Permissions are decided separately, from the work.
   • A learner may believe: “A compromised standard account is harmless.” Respond: It can still read, alter or delete whatever it is allowed to.

   If the explanation does not land: Return to the key card: in a computer system, the door that checks your identity and the list of rooms you may enter are two different things.

   In the lesson window

   • Think it through: A hospital receptionist signs in successfully with a password and a second proof of identity. Should the system now let them open patients’ test results?
   • Check your understanding: An attacker phishes a shop assistant whose account can only edit the shop’s product descriptions. What is at risk?

7. 6. Related ideas, different purposes Check 7 min

   Purpose: Separate least privilege, need to know and separation of duties, using the table.

   Ask

   • Dana requests with one account and approves with another. Separation of duties?

   Responses to expect

   • Many say yes. Ask whether anyone but Dana is involved in the payment.
   • On screen in turns: the opening; then authorisation; least privilege; need to know; separation of duties; how the related ideas differ; the check question on Dana’s two accounts, and its answer.

   Misconceptions to challenge

   • A learner may believe: “Two accounts for one person is separation of duties.” Respond: It needs the sensitive steps divided between different people or roles.

   Discussion pause: The table reveals one idea at a time: ask the class for its own example of each before the row appears.

   In the lesson window

   • Check your understanding: In a small charity, Dana requests payments with a standard account and approves them with an administrator account. Is that separation of duties?

8. 7. Applying and reviewing access Predict 10 min

   Purpose: Apply roles, separate privileged activity, restrict service accounts and review access when jobs change.

   Ask

   • IT added the humanities group and closed the request. What is wrong?

   Responses to expect

   • Most see it once the old science access is pointed out; the worked callout then removes it and checks the result.
   • Diagram: step through the five stages of the access decision and ask who does each one in the learners’ own school or workplace.
   • On screen in turns: the opening; then separating privileged activity; restricting service accounts; the question on the teacher who moved department, and its answer; reviewing access when responsibilities change; the department move, up to listing current permissions; comparing with the new duties, and authorising; applying the change and checking the result; what a useful review checks, and the whole decision as a cycle; the diagram’s stages one at a time; the questions to ask about a request for administrator rights.

   If the explanation does not land: Picture a key ring that gains a key for every new job and never loses one: access that is only ever added builds up.

   In the lesson window

   • Think it through: A teacher moves from science to humanities. IT adds the account to the humanities group and closes the request. What has gone wrong?

9. 8. Apply it in a new situation Apply 4 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The finance question checks limiting elevated access to a task; the service-account question checks that an attacker gets the account's rights, not the job's.
   • On screen in turns: the opening question, its answer; then the question on the overpowered service account, and its answer.

   In the lesson window

   • Apply it: A finance assistant asks for permanent administrator rights to install one approved reporting tool. What is the best response?
   • Apply it: A backup service account was given full administrator rights over every server “to avoid permission errors”. An attacker steals its password. What can they now do?

10. 9. Check your understanding Check 5 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The review question is multiple-select; remind learners to choose every action that applies.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

11. 10. Revision takeaway Consolidate 4 min

    Purpose: Summarise the four questions to ask about any access, the five points and the misunderstandings.

    Ask

    • Without looking: what four questions would you ask before granting access?

    Responses to expect

    • What must it do, what information does it need, who approves, when is it reviewed.
    • On screen in turns: the opening; then what least privilege does not do; the summary; the key terms; the common misunderstandings.

12. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Start from the work: grant what the task needs and nothing beyond it.
    • An attacker in an account inherits exactly that account's permissions.
    • Identity is settled at sign-in; permission is a separate decision.
    • Need to know and separation of duties are related to least privilege but answer other questions.
    • When a job changes, remove the old access as well as adding the new, then check.

Consolidation

• Start from the work: grant what the task needs and nothing beyond it.
• An attacker in an account inherits exactly that account's permissions.
• Identity is settled at sign-in; permission is a separate decision.
• Need to know and separation of duties are related to least privilege but answer other questions.
• When a job changes, remove the old access as well as adding the new, then check.