2.3 POLA: The Principle of Least Access

One of the most common (and commonsense) concepts in computer security is POLA, the principle of least access. It simply states that employees should have access to only the resources they need to perform their day-to-day tasks. POLA applies to noncomputer security, although most people don't think of it that way very often.

You may also hear POLA referred to as the principle of least privilege.

For example, suppose you work for a bank. As in most banks, your customers' data is kept in computer files, but you still have to maintain paper records for many documents, such as signature cards. Those cards might be kept in locked cabinets in your bank's headquarters. Tellers don't need to access the signature cards very often, so they aren't given keys to the cabinets. When a teller needs to access a signature card, he asks a manager to unlock the cabinet and retrieve the card. That's POLA in action. It's not that the bank doesn't want the tellers to see the cards; the bank just doesn't want tellers to have casual access to the cards. The tellers have the least amount of access possible for the day-to-day needs, and when they need to go beyond those needs on occasion, they have a means to do so.

In the world of computer security, POLA is most often applied to administrators. Although administrators have job tasks that require a great deal of privilege over computer systems, they're also regular users who check email, work with Microsoft Word, and surf the Internet. POLA means that administrators should have a regular user account that doesn't have administrative privileges and that they should use that account when they're performing regular, day-to-day tasks. A second computer account might belong to the Domain Admins group, and administrators would log on with that account to perform administrative tasks.

POLA offers real security benefits in any environment. Because of the job tasks they must complete, administrators (when logged on with an administrative user account) have an incredible amount of control over a company's computer systems. Programs like viruses can take advantage of that control and wreak havoc on a company's network. When administrators use a regular user account, though, they can perform only actions that a regular user could perform?limiting the scope of damage a malicious virus can cause.

This book describes numerous technology-specific ways to implement POLA. These methods often restrict users or force role separation between user accounts. However, POLA doesn't come from these software enforcements. POLA must be a direct result of a strong security policy and good administrative practices. Security policy is discussed in Chapter 15, and good administrative practices are discussed throughout this book.

Remember that Windows Server 2003 supports the RUNAS command, which allows an administrator to log on to her client computer using a regular user account and then launch administrative utilities under the authority of an administrative user account. RUNAS helps maintain the security principle and protection of POLA.