This is the age of the data breach. According to cybersecurity advocate DataProt, 68 records are lost or stolen each second, generating an average data breach cost of $3.92 million. Data breaches are a big business, and it’s getting bigger by the moment. What is disheartening about these facts is that it doesn’t have to be this way —some very basic data security practices can be adopted to help ensure your organization is not as vulnerable to these sorts of attacks and failures.

One such fundamental cybersecurity practice is the principle of least privilege. While it’s a core principle, it’s not always understood by novice security implementers. Below, we’ll define what the principle of least privilege is and how to enforce it. We’ll also explore access control and how the two impact API security.

Understanding The Principle of Least Privilege

Who needs to know what? This is actually a valid question, and if understood properly, could lead to quite an increase in security posture. The best way to answer that question is to use something called the principle of least privilege.

In essence, the principle of least privilege argues that a user or entity should only have access to the systems, data, resources, or applications that are minimally needed to accomplish their specific task. Limiting permissions in this way reduces the overall attack surface by reducing the potential routes of escalation for most users. For example, if a vendor or partner is breached, the potential damage is substantially reduced, since attackers can only access a tiny slice of the system.

A least privilege approach doesn’t remove the risk to a system — it simply contains it. For instance, a shipping vendor breach will still result in shipping information exposure. The main point, however, is that the impacted information is severely reduced compared to a system that gives all users the same degree of open access. And, if the API is designed correctly, it could actually mitigate most attacks in combination with multifactor authentication and heuristic monitoring.

The Benefits of the Principle of Least Privilege

Following a least privilege model delivers some significant benefits over other paradigms. Here is a handful of positive outcomes of embracing the principle:

• A better security posture: Having a user who can, in theory, access millions of data points and hundreds of internal systems is a massive security risk. By adopting this principle, the security posture of any organization can dramatically improve, reducing the potential for damage and attack significantly.
• Reduced attack surface: By reducing the potential attack points, you reduce the attack surface overall, allowing organizations to spend more attention and resources on the attack vectors which are most likely to be attacked. Having side channels of potential attacks only makes you less secure, and this principle mitigates those side channels significantly.
• Limited attack propagation: Ensuring that users cannot escalate attacks through unlimited access routes means that attacks are relatively limited in scope when they occur. This includes unguided attacks such as malware or ransomware.
• Improved auditing: When entities, whether external client applications or internal users, are limited to only what they theoretically need to do, auditing is made much easier since there are far fewer routes to deal with.

A Review of Access Control

To fully understand and implement the principle of least privilege, it also helps to understand access control. Access control is a fundamental concept in security that states access to resources and systems can be controlled through physical and logical limitations. These limitations can take a variety of forms.

Physical access is, obviously, focused on physical, real-world controls. Such controls can include secure doorways, air gaps between collections of systems that are behind locked gates, and electronic access systems that require control cards. Physical access is the most obvious system in most security postures and is the most familiar to the layman. When you think of physical access, think of the front door to your house.

Logical access, on the other hand, is a bit more abstract. Logical access includes all of the authentication and authorization systems used within software to control access to resources.

Before we go any further, we should define these two terms rather quickly. Authentication and authorization are often used interchangeably by new entrants into the security space, but they are actually separate domains. Authentication is proving that you are who you say you are, whereas authorization is proving that you have the right to access what you say you can. In simple terms, authentication is justifiable proof that you are Mrs. Tech Expert, while authorization is justifiable proof that you have the right to read this piece.

What is important to remember about access control in the logical sense is that it’s not an all-or-nothing net-zero game. Whereas physical access is often a gate — either you’re allowed in an area or you’re not — logical access can be much more granular with different access levels.

Example: Least Privilege Shipping API

Imagine we have a shipping API that users can use to create profiles, update their shipping information, and request a product be shipped to them. Each step of that process, and its associated data, should have different access states depending on the type of user requesting it.

Customer support staff might need to access everything, such as account management, billing, and product endpoints. But shipment fulfillment staff only need to know the product and the shipping address — they don’t need to see the payment information outside of whether the product is paid for or not.

Further, the packing group only really needs to know if the shipment was authorized and where it’s going — there’s no real reason for these groups to have specific information beyond what they need to do the job.

Conclusion

The principle of least privilege is a deceptively simple concept, but in application, a potent approach to ensure a greater level of security for all connected systems. Adopting a zero-trust architecture can lead to much greater security and peace of mind, and the first step on that journey is adopting the principle of least privilege.

Did we cover the most important parts of this concept? Let us know anything we missed in the comments below!