Web Commerce Security Design and Development

Principle of Least Privilege

The principle of least privilege supports defense-in-depth and reduces the attack surface. This principle requires that a subject has the proper and minimum number of privileges on the computer system necessary to perform a specific task, rather than assigning a general set of privileges for all tasks performed. Then, a list should be made of resources each subject must access and the specific tasks it must perform to identify the appropriate privilege level. Each subject may also temporarily elevate privileges to perform a specific task, but must immediately relinquish privileges when the task is completed. The level of privilege should be enforced at the lowest level in the software stack and at the finest granularity.

In practice, this means the most restrictive set of operating system permissions or access control list (ACL) entries should be applied to all application files, including executables and configuration files. The application should also run as a low privilege user account, with the smallest amount of privileges necessary to accomplish the application tasks. If the application is compromised, it should not have access to the resources of the entire operating environment.

A common example of least privilege in operation is the Apache Web server running on a *nix operating system such as Linux. When Apache first starts up, the parent httpd process runs as the highest privileged account on the system, known as root or superuser. The parent ...