{"id":6092,"date":"2021-02-01T17:10:01","date_gmt":"2021-02-01T22:10:01","guid":{"rendered":"http:\/\/andreas-wolter.com\/?p=6092"},"modified":"2025-07-28T17:17:45","modified_gmt":"2025-07-28T22:17:45","slug":"202102_principle-of-least-privilege-polp","status":"publish","type":"post","link":"https:\/\/andreas-wolter.com\/en\/202102_principle-of-least-privilege-polp\/","title":{"rendered":"Principle of Least Privilege (POLP)"},"content":{"rendered":"

Principle of Least Privilege (POLP)<\/h3>\n

(part 1 of my series of articles on security principles in Microsoft SQL Servers & Databases<\/a>)<\/em><\/p>\n

The first security principle that I am going to discuss is one that most System Administrators are familiar with: the \u201cprinciple of least privilege\u201d (short: POLP). It demands that the required permissions for a task shall only grant access to the needed information or resources that a task requires<\/u>. When permissions are granted, we shall grant the least privileges possible.<\/p>\n

POLP is so crucial because initially it is the privileges that any attacker is targeting. When developing an application, using a least-privileged user account<\/em> (LUA) is the first rule of engagement.<\/p>\n

Note<\/em>
\nUser Account Control<\/em><\/a> (UAC) in Windows is a feature that Microsoft developed to assist administrators in working with least-privileges by default and elevate to higher permission only when needed.<\/p>\n

You may also know that Microsoft recommends separating service accounts. This security best practice is generally referred to as service account isolation<\/em><\/strong> and is related to POLP: Using distinct service accounts prevents increased privileges, which happens easily when you share an account to be used for multiple purposes and as a consequence, the privileges are merged. – This would violate the principle of least privilege.
\nBoth POLP and service account isolation help reducing the attack surface (aka attack surface reduction<\/em><\/strong>).<\/p>\n