Least Privilege Awareness

What Is Least Privilege Awareness?

Permissions accumulate quietly. People change roles, nobody hands anything back, and a quarterly review is the first time the total is visible. You'll sit on the employee side of that review with write access to a database you no longer touch, admin rights on a system you left, and a legacy tool you still occasionally need. You'll decide what to keep and what to surrender, send the review for approval, then see what those choices meant when the account was later phished.

What You'll Learn in Least Privilege Awareness

• Explain the principle of least privilege and how it limits the blast radius of a compromised account
• Complete a quarterly access review, judging each permission against what your current role actually requires
• Recognize permission creep as the accumulation of access from previous roles rather than a one-time setup mistake
• Decide correctly on ambiguous access that is rarely used but still occasionally needed, instead of keeping it by default
• Connect reduced standing access to reduced damage when an account is compromised in a phishing campaign

Least Privilege Awareness — Training Steps

1. A Growing Role

   Over time, your role has evolved significantly. You started in operations, moved to compliance, and now work in strategic planning. Along the way, you accumulated access to various systems - some of which you no longer use.

2. The Quarterly Access Review

   Harmon Financial conducts quarterly access reviews as required by SOX compliance. Every employee must review their current access rights and confirm they still need each permission. Alice receives an email from the IT Security team about the upcoming review.

3. Opening the Access Portal

   The email from IT Security explains why access reviews matter: unused access creates unnecessary risk, permissions should match your current role, and reducing your access footprint protects you if credentials are compromised. Alice clicks the link to access the Access Review Portal where she can review and manage her permissions.

4. Logging In

   The Access Review Portal login page appears. Alice uses her saved credentials from the password manager to log in securely.

5. Reviewing Current Access

   The portal displays Alice's current access rights across all systems. She's surprised by how much access she has accumulated: Current Access: Customer Database (Read/Write) - From her operations role 2 years ago Compliance Audit System (Admin) - From her compliance role 1 year ago Strategic Planning Portal (Read) - Current role requirement Financial Reporting Dashboard (Read) - Current role requirement Legacy CRM System (Full Access) - System she hasn't touched in 18 months

6. Understanding the Blast Radius

   The portal explains the concept of 'blast radius' - the potential damage if your account is compromised. Your Current Blast Radius: 5 systems with direct access Over 50,000 customer records accessible Admin rights to compliance audit logs Full access to legacy CRM data If Alice's credentials were stolen through phishing, an attacker would have access to ALL of this. By reducing unnecessary access, she shrinks her blast radius and limits potential damage.

7. Evaluating Customer Database Access

   The first item is Customer Database access. Alice had Read/Write access from her operations role, but she hasn't needed to access customer records in over a year. Questions to consider: When did I last use this access? Does my current role require it? Could I request temporary access if needed later? For Alice, the answers are clear: she no longer needs this access.

8. Evaluating Compliance System Admin Rights

   Next is the Compliance Audit System. Alice had Admin rights from her compliance role, but she transferred to strategic planning a year ago. Admin rights are particularly sensitive because they allow modifying audit logs - something that requires strict accountability and should only be held by active compliance team members.

9. The Legacy System Question

   The Legacy CRM System is more complicated. Alice has Full Access, but the system is rarely used. However, she occasionally needs to pull historical data for strategic reports. Options: Keep Full Access - Maintains current risk level Request Read-Only Access - Reduces risk while preserving research capability Remove Access - Request temporary access when needed The principle of least privilege suggests requesting Read-Only access - she doesn't need to modify data, only read it.

10. Confirming Current Role Access

    The final items are the Strategic Planning Portal and Financial Reporting Dashboard. These are both required for Alice's current role and she uses them regularly. The portal shows these as 'Confirmed - Required for current role.' No action needed for access that matches current job functions.