Least Privilege

In practice, least privilege means a customer service representative can view customer records needed for their role but cannot export bulk data or access system administration functions, and a marketing employee has no access to financial systems at all. It also applies to technical accounts and automated processes, such as an application's database connection using an account that can only read the specific tables it needs, rather than one with full administrative rights. Implementing least privilege usually requires an initial access review to identify and remove excessive permissions that have accumulated over time as roles changed.

This principle matters because it directly limits the blast radius of nearly every other security failure: if a phishing attack steals a low-privilege account's credentials, the attacker can only do as much damage as that account was permitted to do. Over-provisioned accounts are a common finding in security audits, often the result of employees changing roles internally without their old access being removed, a pattern common in growing organizations across Indonesia's financial and government sectors. Without least privilege, a single compromised account, whether through phishing, malware, or insider misuse, can expose far more than necessary.

Implementing least privilege requires regular access reviews, role-based access control that ties permissions to job function rather than individual requests, and prompt removal of access when an employee changes roles or leaves the organization. Just-in-time access, where elevated permissions are granted temporarily for a specific task and automatically expire, further reduces standing privilege without slowing down legitimate work. Combining least privilege with strong logging of privileged actions ensures that even necessary elevated access remains auditable.