N100FN100F
Published on

Least privilege, for real

Everybody says they apply least privilege. Almost nobody measures the distance between the permissions each identity holds and the ones it actually uses. That distance is, in practice, the internal attack surface.

Service line Cybersecurity

The permission nobody uses

An identity is given broad permissions to resolve something urgent. The problem gets resolved; the permissions stay. An application is deployed with an administrator role 'so that it works' and nobody reviews it again. Within a year, most identities hold far more permissions than they need.

While nothing happens, it does not show. When one of those identities is compromised, the attacker inherits everything it held, not just what it used.

Assigned against usedPermissions assigned and used over 90 days by six identities: 18% gets used.SECURITY · PRIVILEGESAssigned against usedPERMISSIONS ASSIGNED AND USED OVER 90 DAYSana.p (person)60 of 120luis.g (person)42 of 90app-orders0 of 300app-invoices0 of 280backup-daily31 of 60ci-build47 of 150usedassigned, unused18% of what is assigned gets used.Two applications with administration permissions used none in 90 days.Illustrative data; they do not correspond to any real caseN100F · n100f.com

Assigned against used

The clouds record which actions each identity performs. Comparing what is assigned with what is used over a period (90 days, for instance) reveals the real distance:

  • Permissions never used: clear candidates for removal.
  • Identities with no activity: accounts that can be disabled.
  • Broad permissions where a specific one would do: access to all storage when only one folder is used.

Reducing without breaking

Removing permissions is frightening, because something may stop working. It is done in steps:

  1. Start with the unambiguous: inactive identities and permissions unused for a long time.
  2. Reduce with notice: the owner is told what will be removed and when.
  3. Watch afterwards: if something fails for want of a permission, it shows in the logs and it is granted in a bounded way.
  4. Repeat on a schedule, not just once.

What governance already solves

The foundation is in other pieces of the Governance series: a single identity, roles defined once and sensitive permissions that are requested and expire on their own. Least privilege 'for real' is what you add on top: measuring the distance between assigned and used, and closing it regularly.

Identities are one door. The other, used more and more, is the software itself: what you write and, above all, what you import.

How we apply it: Cybersecurity.

If your cloud cost keeps growing and nobody knows why, or your architecture depends on whoever built it, let’s talk.

Let’s talk