Least privilege

1. Define the Access Control Policy

Formalise a high-level policy document that mandates the principle of least privilege as the default security posture. This document must be approved by senior management to ensure organizational alignment.

• Identify legal and regulatory requirements for data access.
• Specify the “deny-by-default” rule for all new network assets.

2. Compile a Comprehensive Asset Register

Catalog all information assets, including hardware, software, and data repositories. You cannot secure what you have not identified: ISO 27001 requires a link between assets and their specific access requirements.

• Assign an owner to every identified asset.
• Classify data based on sensitivity (e.g., Confidential, Restricted).

3. Map User Personas and Job Roles

Create a Role-Based Access Control (RBAC) matrix. Group users by functional requirements rather than individual names to ensure permissions remain consistent and manageable as the team scales.

• Document the minimum permissions required for each business role.
• Identify “Privileged Users” who require administrative capabilities.

4. Provision Standard User Accounts

Ensure that 100% of employees conduct daily tasks using standard accounts without administrative rights. This prevents accidental system-wide changes and limits the impact of malware or phishing attacks.

• Disable local admin rights on all company workstations.
• Separate personal web browsing from administrative sessions.

5. Implement Multi-Factor Authentication (MFA)

Mandate MFA for all access points, especially for privileged accounts and remote connections. This serves as a critical secondary layer of defense if primary credentials are compromised.

• Use hardware tokens or authenticator apps rather than SMS.
• Enforce MFA for all SaaS and cloud infrastructure logins.

6. Enforce Just-In-Time (JIT) Elevation

Deploy technical controls that allow users to request elevated privileges only when necessary. Access should be granted for a specific timeframe and automatically revoked once the task is complete.

• Log all instances of privilege elevation for audit purposes.
• Utilize a Privileged Access Management (PAM) workflow.

7. Establish a Formal Onboarding and Offboarding Process

Document the workflow for granting access to new starters and, crucially, revoking access immediately upon termination. Stale accounts are a primary target for external threat actors.

• Update the Asset Register during every personnel change.
• Conduct a final access audit on the employee’s last day.

8. Segment the Network Infrastructure

Apply least privilege to the network layer by isolating sensitive data environments. Use firewalls and VLANs to ensure that a breach in one department cannot spread to the core production database.

• Limit lateral movement through micro-segmentation.
• Restrict access to the Management Plane of your cloud environment.

9. Maintain a Robust Audit Trail

Configure centralized logging to capture all successful and failed access attempts. This provides the “Evidence of Control” required by ISO 27001 auditors during a certification assessment.

• Store logs in a read-only, secure repository.
• Review logs regularly for anomalous access patterns.

10. Conduct Quarterly Access Reviews

Audit permissions every 90 days to identify “Privilege Creep,” where users accumulate rights they no longer need. Revoke unnecessary permissions to return the environment to its “Least Privilege” baseline.

• Produce a Record of Evidence (ROE) for each review session.
• Verify that “orphaned” accounts for former staff have been deleted.