Least Privilege Access

Least privilege helps to minimize the impact of a privileged account attack. By default - or by design, as covered in Secure by Design - no identity, human or system, should be able to do anything beyond what is strictly required for its function. No access exists until it is explicitly granted for a specific, justified purpose.

A backup administrator account is frequently the single most powerful identity in the environment: it can read, modify, delete, and restore data across every system the backup solution protects. It is a primary target once an attacker has a foothold on any endpoint.

This section covers four concrete levers for applying least privilege to backup infrastructure:

• Granular Roles / Restricted Backup Admin - giving each user the smallest set of permissions their job requires, rather than defaulting to full administrative rights.
• IAM Best Practices - the lifecycle discipline (provisioning, review, deprovisioning) that keeps granular roles granular over time, instead of accumulating permissions no one revokes.
• Four-Eyes Principle - ensuring that destructive or high-impact actions cannot be completed by a single identity acting alone, regardless of that identity’s role.
• Multi-Factor Authentication - verifying that the identity performing an action is who it claims to be, before role and permission checks become relevant. This mitigates the risk of stolen or leaked credentials being used on their own to gain access.

Four-Eyes is given particular weight in this section. A well-scoped role still allows its holder to act unilaterally; four-eyes control prevents a single compromised or malicious account from independently completing an action, regardless of the permissions the role has.

This section overlaps in places with segmentation, covered under Assume Breach: both reduce what a compromised identity or system can reach. The distinction is scope. Here, the segmentation is of identities and users - who can do what. Under Assume Breach, segmentation applies to IT systems - storage, networks, communication paths.

Least privilege does not eliminate risk. As covered in Secure by Design, some residual risk always remains - least privilege reduces and mitigates the impact of a compromised account, it does not remove the possibility of compromise.