9. The Application of Cybersecurity: Principles and Practices 225 and reinforcing the least secure aspects of an infrastructure than to just add security where it is most convenient to do so. When it comes to a chain, reinforcing the strongest link has no impact on its overall performance and is a waste of resources. In security, making the walls thicker and higher will not contribute anything as long as there is an unlocked door that attackers can just walk right through. As we saw in Section 4.1.2.1 there is saying in cybersecurity about humans being the weakest link in cybersecurity. This is why social engineering is one of the most pursued and effective attack vectors. Attackers are not going to spend countless hours crafting a complex exploit to gain unauthorized access if they can just compose a spear phishing email (i.e., a highly targeted phishing attack) to obtain login credentials to the network. According to this principle, it may be tempting to spend resources on the latest and greatest security technology, but it is likely better for cybersecurity to spend those resources on cyber awareness training and on security processes for employees. The weakest link principle helps cyber defenders to scrutinize where attacks may come, and to spend their limited resources bolstering the most cost-effective barriers. 9.1.6 Least Privilege “A man’s got to know his limitations.” - Clint Eastwood as Dirty Harry As we have seen throughout this textbook, cybersecurity is concerned with preventing unauthorized access to computer systems and data, making access control the means of cybersecurity. In computer systems, access control assigns subjects permissions to objects—permissions such as read, write, and execute. The principle of least privilege states that permissions should be granted only up to the level needed and only for as long as necessary. In other words, users and other resources should be given the least privilege necessary to perform their functions. This principle seems like common sense, but it is often ignored because it is easier to assign permissions liberally. Managing fine-grained access control can be tedious and time consuming. For example, when a new employee begins working at a company, the specific accesses he needs may not be fully known. The temptation is to just give him every permission he may end up needing because this will save time and hassle later and make the organization more efficient. However, doing this would be a violation of the least privilege principle. What it gains in work efficiency it costs in cybersecurity exposure. A new employee would never be given a master key to every building and room at an organization just in case he might need it—this would be taking obviously undue risk. In cyberspace, the danger in giving a user administrator access to computer systems and networks is not as readily apparent, but it is similarly risky. Another temptation is to give permissions to a resource when they are only needed temporarily, but then not have a process in place to rescind the permissions later when they are no longer needed. This results in people being given access for longer than they
RkJQdWJsaXNoZXIy MTM4ODY=