Comparison
Just-in-time accessvsPrivilege creep
Just-in-time access
nobody holds production access by default; you request it, state why, and it expires by itself in an hour.
Granting elevated permissions temporarily on request rather than holding them permanently. It shrinks the standing blast radius of any compromised account to almost nothing and produces a record of who needed what and why. It only works if the request path is fast, since anything that adds minutes during an incident gets replaced by a permanent grant someone made 'temporarily'.
Full entry →Privilege creep
the role was widened during an incident three years ago and nothing has ever narrowed it again.
The one-way accumulation of permissions over time, because granting is urgent and revoking never is. It is why the average production role bears no resemblance to what the workload uses, and why access reviews find identities with permissions for systems that no longer exist. The practical counter is data rather than diligence: most clouds report which permissions an identity has actually used, and the unused ones are the list.
Full entry →