04 / 08 of 8
Respect
pronounced ray
Domain: Least privilege and access control
Grant only what duty demands. Surplus privilege invites disorder.
Respect every boundary you are given access to.
Privilege gives you capability. It does not give you permission to use that capability everywhere.
Least privilege limits access to what a role requires. Segmentation limits where systems can communicate. Data classification limits who should handle information. Separation of duties limits what one person can control.
The same principle applies to vulnerability disclosure. Finding a weakness does not make exploitation or public disclosure automatically appropriate.
Security depends on boundaries being meaningful.
Standing admin rights granted once and never reviewed.
When Rei is absent, access expands until capability becomes ownership. Administrators see everything. Networks communicate because they always have. Old accounts survive because nobody wants to disturb them.
Make the behaviour explicit and repeatable.
Define access requirements
Document what access each role actually requires.
Identify trust boundaries
Document important identity, network, application and data boundaries.
Establish access owners
Every sensitive resource has an owner responsible for access decisions.
Classify sensitive information
Define which information requires additional access restrictions.
Establish temporary-access rules
Define how project, vendor, emergency and privileged access is granted and removed.
Embed the behaviour into processes and ownership.
Review privileged access
Regularly remove access that is no longer required.
Expire temporary access
Make temporary access expire automatically wherever possible.
Enforce least privilege
Grant access according to role, task and necessity.
Separate duties
Prevent one person from controlling sensitive approval and execution paths where risk warrants it.
Enforce segmentation
Restrict communication between systems according to documented requirements.
Verify that the behaviour is happening and that it works.
Test access paths
Verify that users cannot reach resources outside their intended scope.
Test segmentation
Verify that prohibited network paths are actually blocked.
Measure excessive privilege
Identify users, service accounts and applications with broader access than required.
Review stale vendor access
Track external identities that remain active beyond their business need.
Audit access exceptions
Measure how many access decisions bypass the normal process.
Use evidence to improve the behaviour and respond to change.
Move toward continuous authorisation
Reassess access based on identity, device, context and resource sensitivity.
Reduce standing privilege
Replace permanent access with just-in-time or task-based access where appropriate.
Revalidate trust boundaries
Review segmentation and access models when applications, organisations or infrastructure change.
Automate entitlement removal
Connect joiner-mover-leaver events to access removal.
Treat access as a lifecycle
Design access from creation through review to removal rather than as a one-time approval.
Database administrators can access production databases.
They do not automatically receive access to customer records.
Access is granted through approved roles and is logged.
Administrative capability does not justify unrestricted data access.
A server in the development environment can reach production because both networks use the same broad firewall rule.
An engineer argues that the connection has never caused a problem.
The architecture team removes the unnecessary path.
A connection should exist because there is a requirement for it, not because nobody has removed it yet.
An external consultant receives access to an internal application for a six-month project.
The project finishes.
The account remains active for another year.
A quarterly access review identifies the account and removes it.
Access must have a boundary in time as well as scope.
A researcher identifies a critical vulnerability in a company product.
Instead of publishing immediately, they contact the vendor and provide technical evidence.
The vendor patches the issue before disclosure.
Having the ability to exploit a weakness does not create an obligation to exploit it.
A system administrator can create a new privileged account.
They cannot approve their own request.
A second person validates the business need.
Respect the boundary between performing an action and authorising it.
Reading: The tightest mapping on the site: every row is direct. Rei is where the metaphor stops being a metaphor.
| Control | Control title | Strength | Why it maps |
|---|---|---|---|
| PR.AA-05 | Access permissions incorporate least privilege | direct | Least privilege in access permissions is Rei stated almost word for word. |
| PR.AA-01 | Identities managed for authorised users and services | direct | Managing identities for authorised users and services is the precondition for granting only what duty demands. |
| Control | Control title | Strength | Why it maps |
|---|---|---|---|
| A.5.15 | Access control | direct | Access control is the operational form of the virtue. |
| A.5.18 | Access rights | direct | Provisioning and reviewing access rights keeps privilege matched to the role over time. |
| A.8.2 | Privileged access rights | direct | Constraining privileged access is where surplus privilege does the most damage. |
| A.8.3 | Information access restriction | direct | Restricting information access enforces need-to-know at the data layer. |