.NET Architecture & System Design Interview Question #153

What is the principle of least privilege?

Security Architecture, Multi-Tenancy & Disaster Recovery Senior Advanced

Quick Interview Answer

Least privilege means giving users, services, processes, and infrastructure only the permissions they need for their required tasks and no broader access than necessary.

Detailed Explanation

Least privilege means giving users, services, processes, and infrastructure only the permissions they need for their required tasks and no broader access than necessary.

It reduces the impact of compromised credentials, programming mistakes, and malicious activity. Permissions should also be reviewed and removed when they are no longer required.

Code Example

Order API identity:
- read Orders
- write Orders

Not:
- database admin
- access unrelated HR data
- infrastructure owner