Least Privilege

What is Least Privilege?

Least Privilege is a security principle under which every user, service, application and device receives only the rights strictly required to perform its own task, and nothing more. The less an account is allowed to do, the less damage a mistake, a stolen account or malware can cause. In OT environments, Least Privilege helps prevent unauthorised actions on critical systems, whether deliberate or accidental. The principle underpins Zero Trust and Defense in Depth and appears in virtually every security standard, from IEC 62443 to NIST SP 800-53.

🧠 Where does the principle of Least Privilege come from?

Least Privilege was formulated in 1975 by Jerome Saltzer and Michael Schroeder in their paper The Protection of Information in Computer Systems, published in the Proceedings of the IEEE. Their definition reads: every program and every user of the system should operate using the least set of privileges necessary to complete the job.

It was one of eight design principles for secure systems. Saltzer and Schroeder named two benefits that still hold today:

• Damage limitation - an accident, error or attack can only use the rights held by the affected account or program
• Fewer unwanted interactions - the fewer interactions there are between privileged programs, the smaller the chance of unintended or improper use of privilege; if misuse is suspected, fewer programs need to be audited

Two related principles from the same list are fail-safe defaults (deny access by default and only allow it explicitly) and separation of privilege (require more than one key for critical actions). Together they form the basis of modern access control.

🔧 How does Least Privilege work in practice?

Least Privilege is not a product but a design choice that applies at every level:

1. Each user, service or component receives exactly the access rights required for specific functions
2. Access to system functions, network segments or devices is restricted via RBAC, ACLs and, in Windows environments, Group Policy from Active Directory or Entra ID
3. Permissions are regularly reviewed and revoked when they are no longer needed
4. Restrictions apply to user accounts, service accounts, applications, network traffic and remote access
5. Combined with Logging, SIEM and IAM, it stays visible who may do what and who did what

🔄 How does Least Privilege relate to need-to-know, separation of duties and PAM?

Least Privilege is often mentioned in the same breath as other concepts. They reinforce one another but are not the same:

The biggest risk is privilege creep: employees who change jobs keep their old rights and gain new ones on top. Periodic access reviews are therefore just as important as granting rights correctly in the first place.

🏭 How do you apply Least Privilege in OT networks?

Least Privilege is harder in OT than in IT, because many controllers have little or no user management and because availability always comes first. Typical points of attention:

• Shared operator accounts - many HMI stations run on a single shared account that stays logged in around the clock. Use roles in the SCADA software itself, give operators access only to their own process area or workstation, and make sure the underlying Windows account has no admin rights.
• Engineering rights - only engineers may make changes to PLCs or SCADA. Restrict programming access to designated engineering stations and use the PLC’s own protection options, such as password protection and a physical or software run/program mode.
• Vendor access - remote access for vendors goes through a jump server with personal accounts, MFA, time restrictions and session recording. Permanent VPN connections are a well-known weak spot; see also Supplier Security.
• Service accounts - accounts for backup, historian or antivirus get only the rights the service needs, and no interactive logon.
• Firewall rules - Least Privilege applies to the network too. Between zones, allow only the required source, destination, port and direction through network segmentation, VLANs and the zones and conduits model. Rules such as “any-any” do not belong in an OT network; firewall rule management keeps the rule set clean.

Crucially, Least Privilege must never block an emergency intervention. An operator must always be able to bring a process to a safe stop, even when the domain controller is unreachable. OT systems therefore often use local break-glass accounts kept in a sealed envelope or safe.

🔐 What do IEC 62443, NIST and ISO 27001 say about Least Privilege?

In IEC 62443, Use Control is the second of seven foundational requirements. FR 1 governs who you are (identification and authentication); FR 2 governs what you may do afterwards. For Dutch organisations, NIS2 takes effect through the Dutch Cybersecurity Act (Cyberbeveiligingswet), which entered into force on 15 August 2026 without a transition period and makes an access control policy based on Least Privilege a concrete duty of care for essential and important entities.

🧭 How do you implement Least Privilege step by step?

1. Inventory accounts and rights - map all personal, shared, service and vendor accounts, including local accounts on HMIs and engineering stations.
2. Define roles - for example operator, shift supervisor, process engineer, maintenance technician, OT administrator and vendor. Record for each role which systems and functions are needed.
3. Separate administration from daily work - give administrators a separate account and route privileged access through PAM and a jump server.
4. Remove unnecessary rights - withdraw local admin rights, disable default accounts and change default passwords.
5. Restrict network paths - translate the roles into firewall rules between zones and conduits.
6. Log and monitor - send logon, change and permission-change events to a SIEM and respond to use of privileged accounts outside working hours.
7. Review periodically - check rights at least annually and immediately when someone changes role or leaves, automate revocation where possible, and include this in the internal audit.

Common pitfalls are a “temporary” exception that is never withdrawn, service accounts with domain admin rights, and vendor accounts that stay active after a project ends. In 2023 the US CISA and the NSA listed improper separation of user and administrator privilege as the second of the ten most common cybersecurity misconfigurations.

⚖️ What is the difference between Least Privilege and admin by default?

❓ Frequently asked questions

What does the principle of Least Privilege mean?

The principle of Least Privilege means that every user, service or device receives only the rights needed for its own task. Anything beyond that is withheld. This limits the damage a mistake, a compromised account or malware can cause.

What is the difference between Least Privilege and Zero Trust?

Least Privilege is a principle that determines how many rights an account or system receives. Zero Trust is a broader architecture in which no connection is trusted by default and every access request is verified again. Least Privilege is one of the building blocks of Zero Trust.

Is Least Privilege mandatory under NIS2?

NIS2 explicitly lists access control policies in Article 21 as a mandatory measure for essential and important entities. The term Least Privilege is not imposed literally, but it is the standard way to implement that access control policy. In the Netherlands, this is set out in the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026.

How do you apply Least Privilege to shared operator accounts?

For shared operator accounts, limit the underlying Windows account to standard user rights without administrative privileges. In addition, use the user roles in the SCADA or HMI software, so that actions such as setpoint changes are authorised and logged per person. Personal accounts with fast badge or card logon are a good alternative where technically possible.

What is privilege creep?

Privilege creep is the gradual accumulation of rights by a user who changes roles and keeps old permissions. It undermines Least Privilege without anyone consciously choosing to. Periodic access reviews and a fixed joiner, mover and leaver process prevent privilege creep.

What role does PAM play in Least Privilege?

Privileged Access Management (PAM) manages, secures and records the use of administrative accounts. With PAM, administrators receive elevated rights only temporarily and for a specific task, and sessions are recorded. This makes PAM one of the most important technical means of enforcing Least Privilege.

📌 In summary

Least Privilege limits the rights of users, services, applications and devices to what is truly needed, so that mistakes, insider threats and attacks can cause as little damage as possible. Dating from 1975, the principle is reflected in IEC 62443, NIST SP 800-53 and ISO 27001, and in OT it calls for a careful balance between security and availability.