Permissions and Least Privilege

The shop's shared drive has three folders: Stock, Staff Rota and Payroll. Right now everyone can open and edit all three, including Leo, the Saturday helper. Nothing bad has happened yet, but one wrong click, or one stolen password, could expose everyone's pay.

The rule

Give each account only what its job needs, and nothing more.

This is the principle of least privilege. Permissions say what an account may do with a file, folder or system. The classic three:

• Read — open and view.
• Write — change, add or delete.
• Execute — run it as a program (for folders on Linux, it means enter the folder).

On Linux, a file listing shows these for three groups: the owner, the owner's group, and everyone else.

After the first character, read the letters in threes: owner rw- (read and write), group r-- (read only), others --- (nothing). So Priya can edit, the office group can read, and nobody else can touch it.

Least privilege also applies to accounts themselves. Daily work should happen on a standard account. An administrator account is used only when installing or changing the system. If malware runs while you are logged in as a standard user, it can do far less.

The shortcut

For every person and every folder, ask "Who needs it, and to do what?" Start from nothing and add only the permissions that have a reason.

The trap is granting "everyone, full control" because it stops people asking for access. Convenience today becomes exposure tomorrow. Also review permissions when people change roles or leave.

Drills

Answer fast — trust the rule.

Remember

• Give each account only what its job needs, and nothing more.
• Ask "who needs it, and to do what?" and grant read, write or execute only with a reason.
• Trap: "everyone, full control", daily admin accounts, and forgetting to remove access when people leave.