Working with the PoLP
As we mentioned in Chapter 1 when we talked about the Zero Trust strategy, we learned about the PoLP, which states that users, devices, and applications should only be granted access to the minimum level of resources necessary to perform their job functions. Users are often given more access privileges to network resources and data, assuming they only access the resources required to perform their daily tasks. However, this tactic imposes a greater risk of unauthorized access. When users have access to resources they don’t need, attackers can take advantage of it. While providing just enough permissions to apps or users to complete their tasks sounds easy, the implementation can present some challenges. Creating overprivileged applications is never the intention, but usually the result of unplanned actions over time.
Overprivileged applications are software applications that have been granted more access rights, permissions, or privileges than they actually...
