Least Privilege and Segmentation

No defense stops every attacker, so a sensible question is: when someone does get in, how far can they go? That single question has two answers, and they are the subject of this topic. Both share one goal — keep the damage small.

The first is least privilege: give every person and every program only the access they actually need to do their job, and nothing more. The second is segmentation: divide a system into separated sections so a break-in in one part can't simply reach the rest.

Picture a ship built with watertight compartments, where each crew member's key opens only their own area. A leak floods one compartment instead of sinking the ship; a thief who steals one key reaches one room, not the whole vessel. Least privilege is the limited key; segmentation is the sealed compartments. From here we'll use the real terms.

What Is Least Privilege?

Least privilege means handing out the minimum access required for a task, and no more. The person who processes refunds can issue refunds — but can't read the payroll, can't change other people's passwords, can't shut down a server. Each account is scoped to its actual job.

The reason this matters becomes clear the moment an account is stolen. An attacker who takes over an account inherits exactly what that account could do. If the account could only issue refunds, that is the whole ceiling of the damage. The less an account can do, the less harm it can cause when it falls into the wrong hands.

So least privilege is not a judgment about whether people are trustworthy. It is a way to make the worst case smaller. Even a perfectly honest employee's account can be phished or guessed, and a tightly scoped account simply has less to give away.

Why Is Too Much Access Dangerous?

The opposite of least privilege is the over-permissioned account — one that can do far more than its owner ever needs. It feels harmless, and often it is convenient: one account that can reach everything saves a few setup steps.

The problem is that all of that reach transfers to an attacker the instant the account is compromised. An admin account that touches every system is a master key, and a stolen master key is a catastrophe. The same theft against a tightly scoped account is a minor incident.

This is also the heart of the escalation stage of an attack, which we met earlier. Attackers who land on a low-access account go hunting for a higher-access one, because more permissions mean more power. Every account that holds more access than it needs is a prize waiting to be claimed.

What Is Segmentation?

Segmentation splits a system into separated zones, so moving from one zone to another is restricted rather than free. Instead of one big open space where everything can talk to everything, you get walls between the parts — and crossing a wall takes a deliberate, controlled step.

A company might keep the machines that handle payments in their own sealed zone, apart from the ordinary office computers. Someone who breaks into a laptop in the office zone lands in that zone — and finds a wall, not an open path, between them and the payment systems.

Without segmentation, a single foothold sits inside everything at once. This shape is sometimes called a flat network: once you're in, you can reach it all. Segmentation is what turns one wide-open space into a set of separated rooms.

How They Contain a Breach

Put the two together and a break-in changes character. Least privilege means the account the attacker grabbed can't do much; segmentation means the zone they landed in can't reach much. A foothold becomes a dead end instead of a master key.

This is blast-radius thinking — assuming a breach will happen and deciding in advance how far the explosion can travel. You don't stop the attacker getting in; you make sure that getting in one place doesn't mean getting in everywhere.

It also buys defenders something else: time and noise. An attacker who has to break through a wall or hunt for a stronger account is doing extra work, and that extra work is the kind of unusual activity that can be noticed and stopped before it spreads.