What principle is aimed at minimizing the number of individuals who have access to secure information?

Question

Options

• APrinciple of least privilege
• BRisk management
• CData minimization
• DSecurity through obscurity

• A
  93% (42)
• C
  4% (2)
• D
  2% (1)

Explanation

Principle of Least Privilege (A) directly addresses limiting access to sensitive information by granting users only the minimum permissions required to perform their job - no more, no less - which naturally restricts how many people can reach secure data.

Why the distractors are wrong:

• B (Risk management) is a broader process of identifying, assessing, and mitigating threats - it doesn't specifically govern who gets access.
• C (Data minimization) is about collecting only the data you need (a GDPR/privacy concept), not about restricting who accesses existing data.
• D (Security through obscurity) relies on keeping system details secret to deter attackers - it's generally considered a weak, unreliable strategy and has nothing to do with access control.

Memory tip: Think "least privilege = fewest people with keys." Just like you'd give as few people as possible a key to a safe, you give as few users as possible access to sensitive systems.

No community discussion yet for this question.