Least Privilege Awareness
Review your own access before an attacker does.
What Is Least Privilege Awareness?
Permissions accumulate quietly. People change roles, nobody hands anything back, and the total only shows when something goes wrong. You'll phish an analyst's password, sign in as her, and export the customer book using rights left over from a compliance job she left two years ago. Then, as the analyst, you'll run the access review: remove export rights on customer data and admin rights on a system you left, cut a legacy tool you still need to read only, and watch the same export fail.
What You'll Learn in Least Privilege Awareness
- Explain the principle of least privilege and how it limits the blast radius of a compromised account
- Complete a quarterly access review, judging each permission against what your current role actually requires
- Recognize permission creep as the accumulation of access from previous roles rather than a one-time setup mistake
- Decide correctly on ambiguous access that is rarely used but still occasionally needed, instead of keeping it by default
- Connect reduced standing access to reduced damage when an account is compromised in a phishing campaign
Least Privilege Awareness — Training Steps
-
A Page Worth Copying
Bob has registered access-harmonfs.net and put a copy of Harmon's access review portal on it. He did not break into anything to build this. He saved the real sign-in page and changed one thing.
-
The One Thing He Changed
The logo, the wording, the layout and the padlock are all genuine. Only the address is his.
-
Send It
Bob writes to one person. A deadline and a link are enough.
-
Your Review Is Outstanding
Alice's quarterly access review really is outstanding. She has had two reminders about it this month.
-
Open the Portal
The deadline is today and the review is two minutes of work. Alice clicks the link.
-
Sign In
The page that opens looks exactly like the portal Alice signs into every quarter. She types her work email and her password.
-
What the Form Caught
The form never sent anything to Harmon. It wrote to Bob's collector.
-
Her Password, In Full
One capture. The password is not hashed or obscured, because the page that took it was built to keep it.
-
Sign In as Her
Bob goes to the real portal and signs in with what he collected. To Harmon, this is Alice arriving for her access review.
-
What Else the Account Opens
The review portal is only one of the things Alice's account reaches. Bob looks for the rest.
Security Framework Coverage
MITRE ATT&CK
- T1078 Valid Accounts
CIS Controls
- CIS 6 Access Control Management
NIST CSF
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
- PR.AA Identity Management, Authentication, and Access Control