Privilege Creep is the gradual accumulation of excessive access rights or permissions by a user over time. It happens when an employee changes roles, projects, or responsibilities, and their old permissions are not revoked. This results in the user having more access than is necessary for their current role, which can create a significant security risk.
Example
- An employee in the marketing department is temporarily assigned to a project that requires access to sensitive customer data. When the project ends, their access to the customer database is not removed. A year later, they have moved to a different role but still retain the highly privileged access from the previous project. This is a clear case of privilege creep.
ISO 27001 Context
The ISO 27001 standard addresses privilege creep indirectly through its focus on access control (ISO 27001 Annex A 5.15 Access Control), specifically through the principles of least privilege and segregation of duties. Regular reviews of user access rights are a critical control to prevent and mitigate privilege creep.
