The principle of least privilege states that every person, application or account should have only the permissions it needs to do its job, and nothing more. If an accounting account can only see financial data, an attacker who steals it cannot reach the servers or HR records.
Related term in this glossary: IAM (identity and access management)
least privilege, PoLP, minimal privilege, least-privilege access
Related terms
PKI and digital certificates
PKI (public key infrastructure) is the set of rules, authorities and keys that issues and validates digital certificates. A digital certificate is a file that works like an official ID on the internet: it confirms that a website, server or person is who they claim to be and allows communication to be encrypted, as with the HTTPS padlock.
Passkeys and security keys (FIDO2)
A passkey is a way to sign in without a password: your device stores a cryptographic key that you unlock with your fingerprint, face or a PIN. It is based on the FIDO2 standard, like physical security keys such as YubiKey, and it resists phishing because the key only works on the legitimate site.
ZTNA (zero trust network access)
ZTNA (zero trust network access) is a way to give remote access to company applications by verifying identity, device and context on every connection, without opening up the whole network. Unlike a traditional VPN, users only see the applications they are allowed to use.
Microsoft Entra ID (formerly Azure AD)
Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity service that controls who can sign in to Microsoft 365, Azure and thousands of applications. It lets you enforce MFA, conditional access and single sign-on, and it is the foundation of identity security in a Microsoft environment.
SAML, OAuth and OpenID Connect
SAML, OAuth and OpenID Connect are standards that let people sign in or grant permissions between applications without sharing passwords. SAML and OpenID Connect are used for single sign-on (SSO), and OAuth to authorize one application to access your data in another, like when you connect a calendar to your email.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.