ISC2 CISSP (Certified Information Systems Security Professional)Identity and Access Management (IAM)Medium
An organization is implementing an identity management system that must ensure that users can only access resources absolutely necessary for their job functions, and that these permissions are automatically removed when their roles change or they leave the organization. Which principle is MOST critical for the successful implementation and continuous enforcement of this system?
- ASeparation of Duties
- BLeast Privilege
- CDefense in Depth
- DNeed-to-Know
Show answer & explanationAnswer & explanation
Correct answer: B. Least Privilege
The Principle of Least Privilege dictates that users should only be granted the minimum necessary permissions to perform their job functions. This aligns directly with the requirement that access is limited to 'absolutely necessary' resources and is revoked upon role changes or departure.
Why the other options are wrong
- A. Separation of Duties is about dividing critical tasks among multiple individuals to prevent fraud or error, not directly about individual user access levels.
- C. Defense in Depth is a strategy of layering security controls, not a principle for defining individual user access levels.
- D. Need-to-Know is a related concept, often applied within the context of least privilege, but least privilege is the broader principle governing overall access rights.
Principle of Least Privilege (PoLP)
A security principle that requires giving users and processes only the minimum necessary permissions to perform their legitimate functions.
- Reduces attack surface.
- Limits potential damage from compromise.
- Applies to users, applications, and systems.
Memory trick: Least Privilege is Key for Minimum Access