Myths of Least Privilege Management (POLP)

The principle of Least Privilege (PoLP) requires granting identities only the minimum permissions needed to perform their tasks. However, many technical and human factors make PoLP difficult to achieve.

In this talk, we will go through the various dimensions which need to be considered when we are implementing PoLP and what are the challenges in achieving it. While the obvious consideration for least privilege is the set of permissions, we show why factors such as grant timing and duration, and scaling across multiple cloud providers and SaaS applications are important as well.

We show how the lack of automation makes achieving PoLP inefficient, error-prone, and unscalable, and discuss strategies for continuous least privilege.

Finally, we show how to balance security and productivity to ensure widespread adoption of PoLP.