Principle of Least Privilege

What is Principle of Least Privilege?

The Principle of Least Privilege (PoLP) means that users are only given access rights to those applications and data they need to perform their tasks. Users are therefore not given more rights than strictly necessary. In this respect, the Principle of Least Privilege is not only suitable for access security concerning human users. The principle can also be applied between applications.

Examples by industry

What does that Principle of Least Privilege mean in practice? We’ll provide a few concrete examples below:

• Within the education sector, we can organise access rights so that each teacher only has access to the personal information and academic results of the students they teach.
• In a case management system for a local government, you can set up the access rights so that each user only has access to the specific files that government official is responsible for.
• Within healthcare institutions, you can give administrative staff access only to administrative data. Healthcare workers on the other hand can also have access to the medical data of the patients they are responsible for.

In these examples, you can determine for each user to which applications and data they need access, based on each user’s role and responsibilities. All other systems and data are blocked for this user.

Why is Principle of Least Privilege important?

The importance of the Principle of Least Privilege is in two matters, which are related:

• First of all we limit the damage in case an unauthorised individual does gain access via the login credentials of an employee. This person can still get access to your IT systems, but thanks to the Principle of Least Privilege, they can’t access everything immediately. If, for example, the password of an administrative employee gets stolen, the medical records will fortunately remain safe.
• Then again, you don’t want legitimate users to be able to just access everything. Under privacy directives, employees should only be able to access personal data if they actually really to for their tasks. In a hospital for example, healthcare staff can’t just have access to data of clients they are not treating themselves.

What is the difference between the Principle of Least Privilege en Privacy by Design?

By applying the Principle of Least Privilege, you ensure that users only have access to the personal data they actually really need for their work. It’s one of the important principles to comply with privacy directives exactly for this reason. There are, however, more mandatory privacy measures. For instance, all access attempts need to be logged automatically and it is mandatory to record how and when people give permission to use their personal data. You also need to implement measures to make sure personal data is deleted again in a timely manner when it is no longer needed.

To comply with all these privacy requirements, it’s important that IT systems and processes are designed to ensure privacy and data security are a primary concern from the first design design all the way to implementation. This means no isolated or even reactive adaptations added to a system afterwards, but a solution with an architecture where privacy measure are embedded into the DNA. We call this Privacy by Design.

Both principles, Principle of Least Privilege and Privacy by Design, are important in relation to privacy, but they each serve a different goal. Privacy by Design focuses on ensuring your system and process design are fully privacy proof. Least privilege is one principle within that context to take into account.

Advantages of the Principle of Least Privilege

The advantages of the Principle of Least Privilege are very clear now. You limit the damage when unauthorised individuals gain access via login credentials. On top of that, you can prevent employees leaking personal data, knowingly or unknowingly. In that regard, least privilege helps you by preventing data breaches in particular.

Data breaches, the unwanted exposure or distribution of personal data, pose a significant risk to many organisations. They can result in huge claims for damages, especially if it turns out that the organisation hasn’t taken every effort to prevent them. Additionally, the fines imposed can be particularly steep if it turns out the organisation hasn’t invested in adequate security measures. Your reputation will also take an immediate hit if it turns out you’ve been demonstrably negligent with personal data. Investing in least privilege measures therefore always pays off, sooner or later.

How does HelloID comply with the Principle of Least Privilege?

Access security starts with authentication and authorisation. Authentication is verifying a user’s identity, for example with a username and password. Authorisation is the next step and focuses on providing appropriate access rights. Once an organisation grows in terms of users and applications, access management quickly becomes tremendously complicated. You can solve this by automating account management and access rights with an Identity Management System. By making the right choices within this system, you can ensure that your account management fully complies with the principle of least privilege.

HelloID supports least privilege with multiple features:

• We can manage the provision of accounts and access rights based on the role, function, department and other ‘attributes’ of employees as registered in the HR system. HelloID always has the most up-to-date data thanks to a link with that HR system
• All access rights are issued using business rules. These define which access rights are required for which combinations of attributes. This ensures that every employee only receives access rights that are strictly necessary.
• Thanks to the direct link between HelloID and the HR system, data are always up-to-date. If someone changes position, their access rights are automatically adjusted. And if someone leaves the organisation, their account is automatically blocked.
• If an individual requires additional access rights for a specific project, for example, HelloID automates the request process, verification and approval by manager(s). HelloID can also ensure that these additional rights are automatically cancelled again in a timely manner.

The Principle of Least Privilege is embedded within HelloID based on a so-called Attribute Based Access Control framework. The framework is easy to set-up based on flexible business rules. Thanks to those rules you can also adapt that ABAC framework easily if necessary.