Principle of least privilege in Cybersecurity - Mini Project: Build & Apply

Understanding the Principle of Least Privilege

📖 Scenario: You are part of a small company's IT team. Your task is to set up user permissions so that each employee can only access the information and tools they need to do their job.

🎯 Goal: Build a simple permission list that follows the Principle of Least Privilege, ensuring users have only the minimum access necessary.

📋 What You'll Learn

Create a dictionary named user_permissions with exact user names and their assigned permissions.

Add a variable named minimum_access that lists the basic permissions every user should have.

Use a loop with variables user and permissions to check and adjust permissions according to the Principle of Least Privilege.

Add a final step that updates the user_permissions dictionary to remove any permissions beyond the minimum required.

💡 Why This Matters

🌍 Real World

In real companies, limiting user permissions reduces the risk of accidental or malicious damage to data and systems.

💼 Career

Understanding and applying the Principle of Least Privilege is essential for cybersecurity roles, system administration, and IT management.

1

Create the initial user permissions dictionary

Create a dictionary called user_permissions with these exact entries: 'Alice': ['read', 'write', 'delete'], 'Bob': ['read', 'write'], 'Charlie': ['read'].

Cybersecurity

# Create the user_permissions dictionary with exact entries
# Your code here

Hint

Use curly braces {} to create a dictionary and square brackets [] for the list of permissions.

2

Define the minimum access permissions

Add a variable called minimum_access and set it to the list ['read'] to represent the basic permission every user should have.

Cybersecurity

user_permissions = {
    'Alice': ['read', 'write', 'delete'],
    'Bob': ['read', 'write'],
    'Charlie': ['read']
}

# Define the minimum_access list
# Your code here

Hint

Use a list with one string element 'read' to represent minimum access.

3

Check and adjust permissions using a loop

Use a for loop with variables user and permissions to iterate over user_permissions.items(). Inside the loop, update each user's permissions to only include those in minimum_access.

Cybersecurity

user_permissions = {
    'Alice': ['read', 'write', 'delete'],
    'Bob': ['read', 'write'],
    'Charlie': ['read']
}

minimum_access = ['read']

# Loop through user_permissions and update permissions
# Your code here

Hint

Use a list comprehension inside the loop to keep only permissions that are in minimum_access.

4

Finalize the permission update

Add a final line that confirms the user_permissions dictionary now only contains the minimum access permissions for each user.

Cybersecurity

user_permissions = {
    'Alice': ['read', 'write', 'delete'],
    'Bob': ['read', 'write'],
    'Charlie': ['read']
}

minimum_access = ['read']

for user, permissions in user_permissions.items():
    user_permissions[user] = [perm for perm in permissions if perm in minimum_access]

# Final confirmation step
# Your code here

Hint

This step is to ensure the dictionary reflects the Principle of Least Privilege after the loop.

Practice

1. What does the principle of least privilege mean in cybersecurity?

easy

A. Users and programs get only the access they need to do their tasks

B. Everyone should have full access to all system resources

C. Access is granted based on seniority in the company

D. Users can share their passwords to speed up work

Solution

1. Step 1: Understand the principle's goal

   The principle aims to limit access rights to only what is necessary for tasks.

2. Step 2: Compare options with the principle

   Only Users and programs get only the access they need to do their tasks matches this goal by restricting access appropriately.

3. Final Answer:

   Users and programs get only the access they need to do their tasks -> Option A

4. Quick Check:

   Least privilege = minimal necessary access [OK]

Hint: Least privilege means only needed access is given [OK]

Common Mistakes:

• Thinking everyone should have full access
• Confusing least privilege with open access
• Assuming access depends on job rank

2. Which of the following is the correct way to apply the principle of least privilege?

easy

A. Allow users to request any access without review

B. Give all users administrator rights by default

C. Assign permissions only needed for each user's role

D. Share passwords to reduce permission requests

Solution

1. Step 1: Identify correct permission assignment

   The principle requires assigning only necessary permissions per role.

2. Step 2: Evaluate options

   Assign permissions only needed for each user's role correctly assigns permissions based on roles, matching the principle.

3. Final Answer:

   Assign permissions only needed for each user's role -> Option C

4. Quick Check:

   Permissions by role = least privilege applied [OK]

Hint: Assign permissions by role, not full access [OK]

Common Mistakes:

• Giving everyone admin rights
• Skipping permission reviews
• Sharing passwords to avoid permission checks

3. A company has three users: Alice (HR), Bob (IT), and Carol (Finance). According to the principle of least privilege, which access setup is correct?

medium

A. Alice can access HR files only, Bob can access IT systems only, Carol can access Finance data only

B. All users can access HR, IT, and Finance data without restrictions

C. Bob can access Finance data, but Alice cannot access IT systems

D. Carol can access IT systems and HR files, but Bob cannot access Finance data

Solution

1. Step 1: Match access to user roles

   Each user should only access data related to their job function.

2. Step 2: Check options for correct access limits

   Alice can access HR files only, Bob can access IT systems only, Carol can access Finance data only correctly limits access to only necessary areas per user.

3. Final Answer:

   Alice can access HR files only, Bob can access IT systems only, Carol can access Finance data only -> Option A

4. Quick Check:

   Access limited by role = correct least privilege [OK]

Hint: Match access strictly to job roles [OK]

Common Mistakes:

• Allowing all users full access
• Mixing access rights between departments
• Ignoring role-based restrictions

4. A system administrator accidentally gave all users full access to the database. What is the best fix to follow the principle of least privilege?

medium

A. Remove all access rights from users

B. Ask users to share passwords to reduce risk

C. Keep full access but monitor user activity closely

D. Review and assign only necessary permissions to each user

Solution

1. Step 1: Identify the problem with full access

   Giving full access violates the principle and risks security.

2. Step 2: Choose the correct corrective action

   Review and assign only necessary permissions to each user fixes the issue by limiting permissions to what is needed.

3. Final Answer:

   Review and assign only necessary permissions to each user -> Option D

4. Quick Check:

   Fix by limiting permissions = least privilege restored [OK]

Hint: Fix by limiting permissions, not removing all [OK]

Common Mistakes:

• Removing all access causing work stoppage
• Ignoring the problem and just monitoring
• Sharing passwords to 'reduce risk'

5. A software developer needs temporary access to a sensitive database for a project. According to the principle of least privilege, what is the best approach?

hard

A. Grant permanent full access to the database

B. Give temporary access only for the project duration, then revoke it

C. Allow access only after the project is complete

D. Share the developer's access credentials with the team

Solution

1. Step 1: Understand temporary access needs

   Access should be limited to the time needed for the task.

2. Step 2: Select the option that limits access duration

   Give temporary access only for the project duration, then revoke it grants temporary access and revokes it after use, following the principle.

3. Final Answer:

   Give temporary access only for the project duration, then revoke it -> Option B

4. Quick Check:

   Temporary, limited access = correct least privilege use [OK]

Hint: Grant access only as long as needed [OK]

Common Mistakes:

• Granting permanent access unnecessarily
• Delaying access until after work is done
• Sharing credentials among team members