Principle of Least Privilege: PoLP as an Essential Element for IT Security
In the modern corporate world, where cyber threats are becoming increasingly sophisticated, the focus on IT security has never been more important. An essential element in protecting sensitive data and IT systems is the Principle of Least Privilege. In this article, you will learn how this principle is used to minimize risks, protect sensitive company data and systems and ensure compliance with security standards – and also what the serious consequences are if it is not taken into account.
Find out more
Contents
Principle of Least Privilege (PoLP) and its role for IT security
What are the benefits of the Principle of Least Privilege?
What risks arise without PoLP?
How can companies implement the Least Privilege Principle?
What Is the Principle of Least Privilege and Why Is It Essential for IT Security?
The Principle of Least Privilege (PoLP), also known as the Principle of Minimal Privilege or the Principle of Least Authority, means that employees are only granted the minimum access rights in software and technical systems required for their work. This is intended to prevent damage caused by compromised access data or even inside perpetrators. Combined with cryptographically secured authentication, this ensures that only authorized users can operate within the company in accordance with their assigned roles. Access to IT systems, customer data, financial information and other sensitive internal company details is thus effectively protected and controlled.
The efficient and secure implementation of the least privilege principle requires the central administration of identities and user accounts to enable consistent rights management in companies’ typically heterogeneous IT systems. An Identity and Access Management (IAM) software that is tailored to individual organizational requirements and the various user roles is the solution.
What Are the Benefits of the Principle of Least Privilege?
The Principle of Least Privilege is a fundamental component of IT security and therefore a cornerstone of the Zero Trust architecture. The Least Privilege concept implies that no user or system is implicitly trusted. It is not enough to check authorizations only once at the network perimeter – they must be validated continuously with every request to ensure that access is permitted in the respective context. Strict access guidelines in accordance with the PoLP ensure that even attackers who have already gained access to the network must overcome considerable obstacles to gain unauthorized access to systems and data.
Consistent use of the least privilege principle brings numerous advantages that contribute significantly to strengthening the overall security architecture.
Reduction of Security Risks due to Compromised Accounts
The scope of action of hackers can be limited by restricting the access rights of users. The more refined authorizations are assigned to different roles, the more individual accounts attackers would have to compromise to expand their authorizations.
This significantly increases the difficulty for attackers and improves the chances of detecting unauthorized login attempts at an early stage and initiating countermeasures in time to prevent major damage. PoLP also reduces the number of privileged accounts, which enables more effective monitoring and prevents lateral movement, where attackers move from system to system.
Containment of Malware and Exploits
Stolen credentials are just one way for hackers to gain unauthorized access. Often it is not just the accounts themselves that are targeted, but software and services with security vulnerabilities that operate with the rights of a local user. The vulnerabilities are implementation errors that allow attackers to cause unintended behavior. This may range from a program crash to the reading of data or the execution of code.
Once again, the Principle of Least Privilege is important. Because if the software runs under a user with many rights, in the worst case, attackers can use it to execute commands on the system. For example, if software is executed under the root user and remote code execution (RCE) is possible, the entire system can be taken over. Unfortunately, these types of serious security vulnerabilities are not uncommon.
Vulnerabilities that are actively exploited are listed in the CISA catalog “Known Exploited Vulnerabilities” (KEV) of the US Cybersecurity & Infrastructure Security Agency (CISA). If it is possible to limit the rights for software and technical users, this option should be used. This makes the escalation of privileges more difficult for attackers.
Transparency for Assigned Authorizations
The regular check of assigned authorizations required for PoLP provides a detailed insight into the authorization structures and their application in the company. Based on this information, incorrectly assigned or no longer required authorizations can be identified or prevented in advance through guidelines. Along with external monitoring and logging, this information can be essential for investigating security incidents.
Compliance with Legal Regulations and Industry Standards
Implementing access control in accordance with the Principle of Least Privilege significantly supports compliance with legal requirements and industry standards. For example, the Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554 on digital operational resilience in the financial sector, explicitly requires compliance with the PoLP in its regulatory standards (RTS). The NIS2 Directive (EU) 2022/2555 also stipulates the application of zero trust principles, including PoLP, for Critical Infrastructures. Furthermore, both ISO/IEC 27001 (chapter 9 “Access Control”) and the IT-Grundschutz (module “ORP.4.A2”) by the BSI (German Federal Office for Information Security) require the implementation of the principle. For most companies, implementation is therefore unavoidable.
What Risks Arise Without PoLP?
The following scenario illustrates the risks that can arise without implementing the Principle of Least Privilege.
Authorizations According to the Role in the Company
An employee of a financial services provider works in IT support and uses a laptop on which he logs in as a local administrator by default. He prefers this privileged form of access as it allows him to install software himself that he needs for his daily work. He also has access to a ticket system for task planning and distribution, VPN access for working from home and administrative access to certain tools, programs and services (target systems) for which he carries out maintenance.
Change of Position Within the Company
After two years, the employee takes over the management of a team in technical customer support. His role in the company has thus changed: He is now no longer in charge of maintaining systems, but of planning and coordinating tasks for his team in another department. He still uses the same ticket system to do so. However, there are also dedicated projects for customer support that are separate from internal IT support.
Accumulation of Rights Without an IAM System
Since the company does not use an adequate IAM solution, his authorizations are not properly updated. He retains both his new and old access rights, which leads to an accumulation of rights. The employee can still access IT support tickets and has administrative access to systems for which he was previously responsible. This aggregation of authorizations which are no longer required and do not belong to the employee’s current role is also referred to as “permission creep”.
An Easy Target for Hackers
A targeted attack on the company reveals the serious consequences of neglecting the Principle of Least Privilege. Attackers use spear phishing to contact the employee and feign an urgent technical problem with a major customer. The employee opens the email attachment, which contains a zero-day exploit, and infects his system with malware. As he is logged in as a local administrator, the malware can gain maximum rights and bypass anti-virus or EDR software.
The attackers get hold of his access data, including SSO password, SSH key, master password for the employee’s password safe and the data it contains, including the recovery codes for multi-factor authentication (MFA). With this information, the hackers gain access to numerous systems that the employee can log into – including the ticket system and the servers he previously administered. They gain detailed insights into the IT infrastructure along with vulnerabilities and security gaps. Tickets with log data, in which tokens and passwords were logged and incorrectly masked, give the hackers access to further customer access data.
Home Office: Spreading Malware in the Company Network
As soon as the employee connects to the company network over VPN from the home office, the malware loads additional payloads. As the malware runs locally on the employee's laptop, it can also use the VPN connection to attack internal systems and spread throughout the company network (lateral movement) despite MFA for the VPN.
The hackers use the employee’s administrative accounts to gain persistent access to internal systems. With the help of further stolen access data and “hands on keyboard” attacks, they install ransomware on numerous company systems. IT operations are largely disrupted.
Devastating Consequences
Securing the network and restoring systems requires a lengthy and costly process, including hiring digital forensics and incident response (DFIR) experts. The availability of IT systems is severely restricted by ransomware, resulting in significant financial loss. Company and customer data published on the dark web causes serious reputational damage and loss of trust among existing and new customers.
Many of the risks described could have been avoided or significantly reduced by implementing the Principle of Least Privilege. This includes:
Withdrawal of unnecessary authorizations: Authorizations that are no longer required, especially when changing roles or after leaving the company, must be instantly revoked.
Restricting privileged accounts: Privileged accounts should only be made available to employees who have an essential need for them for their activities.
Use of unprivileged accounts: Privileged accounts may only be used for the administration of IT systems. Apart from this use case, the same person must work with an unprivileged account that is limited to the minimum set of authorizations required for their role.
How Can Companies Implement the Least Privilege Principle?
The following steps should be taken to implement the Principle of Least Privilege:
Review Permissions
It is important to check and inventory all accounts, especially privileged accounts, with regard to their authorizations. This should not only include user accounts on operating systems, but also access to applications and services in the network, VPN, cloud/ VPCs and connected SaaS providers. These access points can be implemented using various methods such as passwords, SSH keys, tokens or API keys. In addition, a risk analysis is recommended to determine which systems and data require particular protection.
Define Roles and Minimum Authorizations
Based on the information collected, a role concept should be developed that maps the company’s business processes. This involves identifying which access authorizations to systems, applications and data are required for each employee role.
Determine Guidelines and Processes for Assigning Rights
For implementation, guidelines and processes must be established that specify how rights are assigned and controlled in the company. For example, it must be defined under which circumstances a system administrator or line manager may assign certain rights to employees and which supervisor must confirm this assignment if necessary. It should also be clearly defined who is responsible for monitoring the PoLP.
Employee Lifecycle Management
Lifecycle management for employees is required to ensure that authorizations are continuously managed and maintained. This regulates how authorizations are updated in the target systems when employees join the company, when roles change or when they leave.
Standard Role Assignment for Employees
Once the guidelines and processes have been defined, roles are assigned to existing employees. The authorizations in the existing systems must be adapted in accordance with the PoLP.
Reduction of Privileged Accounts
If the assigned roles do not include privileged accounts for certain employees, these accesses must be blocked. Every person who requires a privileged account should have their own personal account in the target system that is not shared with other employees.
Temporary Assignment of Rights
In order to minimize the number of privileged accounts, access should be provided temporarily on request for tasks that require additional rights. These authorizations or the temporary account should be removed once the task or project has been finished. This principle is also known as “just in time” access.
Blocking Accounts
In the event of suspicious login activities that indicate a possible attack, the authorizations of the affected account must be revoked immediately.
Implement PoLP with the Garancy® IAM Suite
The introduction of the Principle of Least Privilege is a complex project but offers numerous security benefits. Manual review and implementation of the processes is not realistic due to the complexity and high resource requirements, making the use of an IAM tool essential. With the Garancy® Suite, Garancy® Password Management and Garancy® Data Access Governance, Beta Systems offers modern and reliable solutions that companies around the world trust.
Beta Systems Professional Service supports you in establishing Garancy® products in your company and migrating existing systems. If you use individual software, customizing connectors is possible to connect your target systems to the IAM solution.
NAV output management: Close cooperation between NAV and Beta Systems resulted in new functions for Beta DocZ that enabled the successful replacement of CA Spool.
Replacement of the existing schedulers with modern workload automation and output management solutions, and of the file transfer and SAP job control tools with BMC Control-M.
Beta Systems is named a Visionary in the 2024 Gartner Magic Quadrant for Service Orchestration and Automation Platforms. Our innovative ANOW! product roadmap sets us apart in the evolving automation landscape. Download the full report to discover why
we believe Gartner recognizes us for our forward-thinking solutions.
)
)
)
)
