The temp who could see everything
A delivery firm hires a temp for two weeks to answer the phones. To save time, IT gives her the same account as the finance manager.
She can now see every driver’s pay and change any customer refund. She did nothing wrong. But if her password leaks, an attacker can do all of that too.
By the end of this lesson
Note
I can give each person only the access they need.
Key words
| Word | What it means | Example |
|---|---|---|
| Access | being allowed to see or change something | |
| Permission | one thing an account may do | read, write |
| Least privilege | only the access the work needs, no more | |
| Role | a named set of permissions for one kind of job | |
| Leaver | someone who leaves or changes job |
The cells students fill in are left blank in this preview.
Least privilege limits the damage
Least privilege means each account gets only the access its work needs.
Accounts get misused: a password leaks, or someone clicks a bad link. Then the attacker can do only what that account could do. Less access means less damage.
Computers apply the idea to files too. Each file has permissions that say who may read or change it.
Try it: lock down a payroll file
mkdir -p office && cd office
printf 'name,pay\nAmir,2100\nBeth,2350\n' > payroll.csv
printf 'Open 9 to 5\n' > opening-hours.txt
# Who may read and write each file now?
ls -l
# Only the owner may read or write the payroll
chmod 600 payroll.csv
ls -l payroll.csv
# Try: chmod 644 opening-hours.txt, then ls -l again
Worked example: reading ls -l
| What ls -l shows | Owner | Group | Everyone else |
|---|---|---|---|
| -rw-r--r-- | read and write | read | read |
| -rw------- | read and write | nothing | nothing |
| -rwxr-x--- | read, write, run | read, run | nothing |
The cells students fill in are left blank in this preview.
Roles give access by job, not by person
Setting permissions person by person is slow, and mistakes creep in.
Instead, a team defines a role for each kind of job: support, warehouse, manager. Each role lists its permissions. A new starter is given a role, and gets exactly that.
When someone changes job, they change role. Their old access goes with the old role.
Try it: people, roles and actions
# Each role lists the actions it allows
roles = {
"support": ["read_orders"],
"warehouse": ["read_orders", "mark_shipped"],
"manager": ["read_orders", "mark_shipped", "give_refund"],
}
people = {"Dina": "support", "Olu": "warehouse", "Kate": "manager"}
for person in people:
role = people[person]
print(person, "is", role, "and may:", roles[role])
# Olu moves to support. Change his role and run it again.
A common mistake
Warning
Many people think extra access is harmless if the person is trusted. Trust is not the point: accounts get stolen, and mistakes happen. Give only what the work needs, because every extra permission is something an attacker can use.
In a real job
Tip
Teams review access every few months and remove what nobody uses. When someone leaves, their account is switched off on their last day. Expect a hiring manager to ask how you would handle a leaver.