Least Privilege
The principle of granting an identity only the access it needs, for only as long as it needs it. Reduces blast radius when an account is compromised.
Least privilege is universally endorsed and rarely measured, which is the whole problem. It becomes real when you can compare granted permissions against used permissions and act on the difference, and when access is time-bound by default rather than permanent. Without those two mechanisms it degrades into an aspiration that entitlement growth quietly overwhelms.
See also: zero standing privileges, CIEM, entitlement, just-in-time access
Related on Start with Identity
- GlossaryBreak-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a rea
- GlossaryISPM
Identity Security Posture Management. Continuous assessment of identity-related misconfigurations and risk, such as dormant accounts, weak MFA coverage, and ris
- GlossaryRole Mining
Analyzing existing access to discover sensible roles, reducing role explosion and cleaning up entitlements. A common step in rolling out or fixing RBAC. Role mi
- ArticleLeast Privilege Access: Implementation Strategies and Best Practices
Implement the principle of least privilege with practical strategies for monitoring excess permissions, automated right-sizing, and overcoming organizational re
- CVECertifried, AD CS certificate mapping privilege escalation
The 2022 AD CS cert-based privilege escalation, still observed in incident response in 2025 (Rapid7, Unit 42). CVSS 8.8. The durable control is strong certifica
- ArticleIAM Incident Response Playbook: Handling Identity Breaches, Compromised Credentials, and Privilege Escalation
A complete playbook for responding to identity-related security incidents, including credential compromise, privilege escalation, and identity infrastructure at