Employees must be assigned privileges on a need to know basis, with their digital identities configured following the principle of least privilege.
Control Type: Administrative
Control Function: Preventive
In the mid-2020s, identity based cyber threats have become a major area of concern for organizations and individuals alike, with identity compromise becoming a go to for adversaries. Identity threats also stem beyond external adversaries. Insider threats such as disgruntled employees can take advantage of weak identity and access management to damage an organization from the inside.
To properly address the wealth of identity risks from the outset, organizations need to adhere to the principle of least privilege when designing identity systems and provisioning user accounts. Users and groups must be granted privileges on a need-to-know basis, meaning if the user/group doesn’t need access to data or resources to do their job, they should not have access.
For the privileges that are assigned to users and groups, they should be carefully assigned following the principle of least privilege. The principle of least privilege means granting only the bare minimum privileges necessary to accomplish tasks. Nothing more and nothing less. This sounds very simple on the surface, but actually implementing the principle of least privilege requires a lot of fine tuning and trial and error.
Environments change rapidly over time, as organizations expand and new assets are brought in. This growth needs to be reflected in identity and access controls, meaning the principle of least privilege needs to be continuously assessed and changed as needed to capture the current state of the environment. Thus, it is important for organizations to conduct regular role reviews to ensure that the principle of least privilege remains intact.