Securing Windows Server 2003

POLA: The Principle of Least Access

One of the most common (and commonsense) concepts in computer security is POLA, the principle of least access. It simply states that employees should have access to only the resources they need to perform their day-to-day tasks. POLA applies to noncomputer security, although most people don’t think of it that way very often.

Tip

You may also hear POLA referred to as the principle of least privilege.

For example, suppose you work for a bank. As in most banks, your customers’ data is kept in computer files, but you still have to maintain paper records for many documents, such as signature cards. Those cards might be kept in locked cabinets in your bank’s headquarters. Tellers don’t need to access the signature cards very often, so they aren’t given keys to the cabinets. When a teller needs to access a signature card, he asks a manager to unlock the cabinet and retrieve the card. That’s POLA in action. It’s not that the bank doesn’t want the tellers to see the cards; the bank just doesn’t want tellers to have casual access to the cards. The tellers have the least amount of access possible for the day-to-day needs, and when they need to go beyond those needs on occasion, they have a means to do so.

In the world of computer security, POLA is most often applied to administrators. Although administrators have job tasks that require a great deal of privilege over computer systems, they’re also regular users who check email, work with Microsoft Word, and ...