The Principle of Least Privilege

Does your business or organisation use the "The Principle of Least Privilege?

This is when users are only granted the privileges necessary to perform assigned work tasks and no more. Limiting and controlling privileges based on this concept protects confidentiality and data integrity. If users can modify only those data files that their work tasks require them to modify, it protects other files' integrity in the environment.

This principle extends beyond just accessing data but also applies to system access.

Organisations sometimes violate this principle by adding all users to the local administrators group or granting root access to a computer. This gives users full control over the computer. However regular users rarely need this much access. When they have this much access , they can accidentally ( or not intentionally damage the system, such as accessing or deleting valuable data. Additionally if a user has full administrative privileges and inadvertently installs malware, the malware can assume full administrative privileges of the user's account. In contrast if that user only has regular user account privileges the malware can only assume this accounts limited privilege's.

So how serious do you take the data and access privileges on your systems and networks? Do you use this principle or just give users full access for an easy time?