Least privilege: why not everyone should be an administrator

In many companies access rights grow over time: an employee needs a folder for a project, a new program requires admin rights, a former colleague's account is never disabled. Eventually most users can see and change much more than they need — and so can an attacker who steals one of their passwords.

The principle

Least privilege means every person and every service gets only the rights needed for their work — no more, and only for as long as needed.

How to apply it

1. Remove local administrator rights from everyday user accounts. Install software through IT.
2. Grant access by role (accounting, sales, management) using groups, not individual permissions.
3. Separate admin accounts from daily accounts for IT staff.
4. Review access regularly — at least twice a year, and whenever someone changes position or leaves.
5. Protect sensitive data — payroll, contracts, personal data — with separate folders and access logs.
6. Use service accounts with minimal rights and strong unique passwords.

The benefits

Fewer rights mean less damage from malware, mistakes and insider misuse. It also helps meet the requirements of auditors and partners.

Access should be a key to a specific door, not a master key to the whole building.

Need help with this? Contact CySec for a free consultation.

All articles