Comparison
Principle of least privilegevsPrivilege creep
Principle of least privilege
you give the service a database user that can only read the two tables it needs, rather than the one that can drop everything.
Granting only the permissions needed for the task, for as long as they are needed. It does not prevent compromise; it bounds what a compromise reaches. The common violations are boring and universal: an admin credential in CI, a service account with wildcard permissions, a token that never expires.
Full entry →Privilege creep
the role was widened during an incident three years ago and nothing has ever narrowed it again.
The one-way accumulation of permissions over time, because granting is urgent and revoking never is. It is why the average production role bears no resemblance to what the workload uses, and why access reviews find identities with permissions for systems that no longer exist. The practical counter is data rather than diligence: most clouds report which permissions an identity has actually used, and the unused ones are the list.
Full entry →