Least Privilege

Part of the Security Fundamentals section of Coddy's Cybersecurity journey. Lesson 13 of 43.

A person should have the access they need for their job, without extra access they do not use. This is called least privilege. It also limits what an attacker can reach if they steal that person's account.

For example, suppose Ava works in the roastery but was also added to marketing by mistake. Check what that group gives her:

seclab groups marketing

You should see:

marketing: the newsletter and the shop's pages
  members: ava, mia

The group lets Ava change the newsletter and shop pages. She does not need either for roasting coffee, so remove her from marketing:

seclab remove ava marketing

You should see:

Removed ava from marketing.

This removes the extra access while leaving her roastery and staff memberships in place. She can still do her job.

Challenge

Easy

Ticket from Omar, finance

Someone outside Lumen is using our intern's account. A mistaken group membership lets them read payroll. Find the account and remove that extra access before payroll is copied out. The intern must still be able to help customers, and the finance team must keep its access.

Try it yourself

Terminal

Least Privilege

All lessons in Security Fundamentals