Glossary
Least privilege
Least privilege means giving each person and program only the access needed for the work, and nothing more.
What the standards say
NIST SP 800-53 Rev. 5, control AC-6, says to employ the principle of least privilege, “allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.” NIST’s glossary words it as each entity being granted the minimum system resources and authorizations it needs to perform its function. The SOC 2 trust services criteria, in CC6.3, ask the organization to consider least privilege and segregation of duties when it grants and changes access.
Note the words “processes acting on behalf of users”. The principle covers programs and service accounts as well as people.
Why it matters in an access review
Least privilege is easy to apply on the first day and hard to keep. Access grows by small additions: a role for an incident, a group for a project, a broad role because it was quicker. Nobody takes it back. The review is where the principle is checked after the fact. The reviewer’s question is not “did this person ever need this?” but “is this the least they need for the job they do now?” NIST AC-6(7) says the same: review the privileges assigned, validate the need, and reassign or remove them if necessary.
An example
During an outage, an engineer is given realm-admin in Keycloak so she can fix a client. The outage ends. Three months later, the review lists realm-admin against her name. The reviewer asks whether she needs it today. She does not. A narrower role, or the same role for one day, would have followed least privilege. The reviewer rejects the access and an administrator removes it.
Common mistakes
- Judging by job title instead of by the access the account really has.
- Granting a broad role to everyone because it is easier to manage.
- Forgetting service accounts and tokens, which often hold more than any person.
- Treating least privilege as a choice made once at design time, and not as a question asked at every review.