Which principle states that users should be granted only the minimal set of rights necessary to perform their job?

Which principle states that users should be granted only the minimal set of rights necessary to perform their job?

• A. Least Privilege
• B. Need to Know
• C. Separation of Duties
• D. Dual Control

Answer: (A)

The main concept tested is giving users only the minimum set of rights they need to do their job. This is the principle of least privilege. By restricting what an account can do and what data it can access, you reduce the potential damage from mistakes or a compromised credential. If an attacker gains access, they’re limited to a small scope, which helps contain any breach. It also makes it easier to audit and enforce more precise security controls, since permissions are tightly aligned with actual job requirements. In practice, least privilege is often implemented through careful access controls, such as assigning permissions by role, group, or task, and sometimes using temporary or task-based access. For example, a developer might need access to specific development resources but not to production systems, and a support technician might need only read access to certain data rather than full control. Other options describe related but distinct controls. Need to know focuses specifically on who can access particular information, which is a related way to limit exposure but doesn’t capture the broader idea of limiting all rights to what is necessary for the job. Separation of duties prevents fraud or errors by dividing responsibilities among people so no one has control over all steps of a critical process. Dual control requires two people to authorize an action, providing oversight for high-risk operations. Both are important security concepts, but they address process and oversight, not the general practice of restricting a user’s privileges to the minimum needed.

The main concept tested is giving users only the minimum set of rights they need to do their job. This is the principle of least privilege. By restricting what an account can do and what data it can access, you reduce the potential damage from mistakes or a compromised credential. If an attacker gains access, they’re limited to a small scope, which helps contain any breach. It also makes it easier to audit and enforce more precise security controls, since permissions are tightly aligned with actual job requirements.

In practice, least privilege is often implemented through careful access controls, such as assigning permissions by role, group, or task, and sometimes using temporary or task-based access. For example, a developer might need access to specific development resources but not to production systems, and a support technician might need only read access to certain data rather than full control.

Other options describe related but distinct controls. Need to know focuses specifically on who can access particular information, which is a related way to limit exposure but doesn’t capture the broader idea of limiting all rights to what is necessary for the job. Separation of duties prevents fraud or errors by dividing responsibilities among people so no one has control over all steps of a critical process. Dual control requires two people to authorize an action, providing oversight for high-risk operations. Both are important security concepts, but they address process and oversight, not the general practice of restricting a user’s privileges to the minimum needed.