Defense-in-depth is a layered security strategy that aims to protect information and resources through multiple security measures.
One of its key principles is the concept of least privilege, which means providing users and systems with the minimum level of access necessary to perform their job functions.
By assigning only the necessary permissions, the attack surface is reduced, and the potential damage from a compromised account or system is minimized.
This principle helps in mitigating the risk of unauthorized access and limits the capabilities of an attacker if they gain access to an account.
Reference:
Defense-in-Depth Strategy by NIST
Principle of Least Privilege in Cybersecurity
Layered Security Approach Explained