Which principle states that access should be provided only to the minimum necessary to perform tasks?

Which principle states that access should be provided only to the minimum necessary to perform tasks?

• A. Phish Tank
• B. Detection Controls
• C. Least privileges
• D. Controlled access

Answer: (C)

The principle of least privilege states that users should be granted only the minimum rights and access necessary to perform their tasks. This minimizes what someone can do or access, reducing the risk if credentials are compromised and limiting accidental or deliberate misuse. In practice, it’s implemented through controls like role-based access, need-to-know access, and just-in-time elevation when higher privileges are temporarily required. The other terms don’t describe this specific constraint on access: Phish Tank isn’t a standard security concept; detection controls focus on monitoring and alerting rather than limiting access; and controlled access is a broad phrase that doesn’t specify minimizing privileges.

The principle of least privilege states that users should be granted only the minimum rights and access necessary to perform their tasks. This minimizes what someone can do or access, reducing the risk if credentials are compromised and limiting accidental or deliberate misuse. In practice, it’s implemented through controls like role-based access, need-to-know access, and just-in-time elevation when higher privileges are temporarily required. The other terms don’t describe this specific constraint on access: Phish Tank isn’t a standard security concept; detection controls focus on monitoring and alerting rather than limiting access; and controlled access is a broad phrase that doesn’t specify minimizing privileges.