Which statement best captures the essence of the principle of least privilege?

Which statement best captures the essence of the principle of least privilege?

• A. All users should have the maximum rights to perform their job.
• B. Every user should have the minimum rights needed to perform their role.
• C. Privileges should never be revoked once granted.
• D. Access rights should be the same for all users.

Answer: (B)

The principle of least privilege means giving each user only the minimum rights needed to perform their job, nothing more. This keeps the attack surface small and reduces the risk of accidental or intentional misuse because people can access only what is necessary for their tasks. The best statement matches this idea directly by saying every user should have the minimum rights required for their role, which supports security by limiting access to only what is essential. Granting maximum rights undermines this protection, because more access creates more opportunities for mistakes or exploitation. If privileges were never revoked, once someone has access they could retain it longer than needed, increasing risk. And treating all users the same ignores the different needs of roles, which the least-privilege approach explicitly accounts for by tailoring access to what each role requires.

The principle of least privilege means giving each user only the minimum rights needed to perform their job, nothing more. This keeps the attack surface small and reduces the risk of accidental or intentional misuse because people can access only what is necessary for their tasks. The best statement matches this idea directly by saying every user should have the minimum rights required for their role, which supports security by limiting access to only what is essential.

Granting maximum rights undermines this protection, because more access creates more opportunities for mistakes or exploitation. If privileges were never revoked, once someone has access they could retain it longer than needed, increasing risk. And treating all users the same ignores the different needs of roles, which the least-privilege approach explicitly accounts for by tailoring access to what each role requires.