SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/tech-least-privilege

What does the principle of least privilege require?

Give each user or process only the minimum access needed.

Start playing free

  1. Minimum needed access ✔
  2. Administrator access by default
  3. One shared account for everyone

Why: Limiting permissions narrows what a compromised account or faulty process can reach. Access can be added when a task truly requires it.

Huh, didn't know that: Least privilege applies to software processes and service accounts, not just people.

The dad joke
The account asked for every key, but least privilege gave it one door.
Like this card?
Play the game

References

Answer: Minimum needed access. Limiting permissions narrows what a compromised account or faulty process can reach. Access can be added when a task truly requires it.

  1. NIST CSRC Least Privilege Glossary csrc.nist.gov/glossary/term/least_privilege
    each entity is granted the minimum system resources and authorizations that the entity needs to perform its function
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich three goals form the CIA triad?Security & PrivacyWhich password property most directly increases resistance to guessing?Security & PrivacyWhat does current NIST guidance say about password composition rules?

That's stuff everyone should know.