[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fac-6":3},{"item":4,"lessons":18,"controls":69,"related":100},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ac-6","AC-6","Least Privilege",914,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Users, and processes acting for them, should only have the access they need to do their assigned tasks, and nothing more.\n\n**In practice.** Doing this well means role-based access designed around real job functions, separate privileged accounts for administration, just-in-time elevation for admin rights, and removing local administrator rights from standard endpoints. Evidence includes role definitions, privileged access inventories, elevation logs and review results showing excess rights were removed. The idea appears in CIS Control 6 and in the ISO\u002FIEC 27001 controls on privileged access rights.\n\n**Common gaps.** Organisations often grant broad access to avoid friction and never take it back, so permissions accumulate over time. Cloud roles with wildcard permissions and service accounts with domain or tenant-wide rights are frequent weak points.","Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.\nDiscussion: Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},933,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"internet-facing-containers-with-sensitive-data-access-create-exploitable-attack-paths","Internet-Facing Containers with Sensitive Data Access Create Exploitable Attack Paths","2026-11-13T18:21:17.032+00:00",{"slug":26,"title":27,"published_at":28},"unsecured-ai-agent-exposes-enterprise-to-invoice-fraud-via-email-manipulation","Unsecured AI Agent Exposes Enterprise to Invoice Fraud via Email Manipulation","2026-11-13T16:22:22.358+00:00",{"slug":30,"title":31,"published_at":32},"baker-tilly-breach-and-ai-privilege-escalation-highlight-third-party-and-access-control-risks","Baker Tilly Breach and AI Privilege Escalation Highlight Third-Party and Access Control Risks","2026-11-13T16:21:20.633+00:00",{"slug":34,"title":35,"published_at":36},"ai-agent-containment-requires-more-than-pulling-the-plug","AI Agent Containment Requires More Than Pulling the Plug","2026-11-13T12:20:44.927+00:00",{"slug":38,"title":39,"published_at":40},"compromised-iam-credentials-and-third-party-vendor-breaches-expose-customer-data-across-multiple-org","Compromised IAM Credentials and Third-Party Vendor Breaches Expose Customer Data Across Multiple Organizations","2026-11-13T11:21:34.52+00:00",{"slug":42,"title":43,"published_at":44},"north-korean-fake-it-workers-reached-onboarding-and-accessed-sensitive-employee-data","North Korean Fake IT Workers Reached Onboarding and Accessed Sensitive Employee Data","2026-11-13T08:22:51.018+00:00",{"slug":46,"title":47,"published_at":48},"ssrf-flaw-in-aws-mcp-gateway-exposed-internal-networks-and-cloud-credentials","SSRF Flaw in AWS MCP Gateway Exposed Internal Networks and Cloud Credentials","2026-11-12T14:21:00.195+00:00",{"slug":50,"title":51,"published_at":52},"ai-pentesting-tool-abused-to-steal-aws-credentials-and-access-cloud-secrets","AI Pentesting Tool Abused to Steal AWS Credentials and Access Cloud Secrets","2026-11-12T12:20:40.179+00:00",{"slug":54,"title":55,"published_at":56},"citrus-ransomware-exploits-stolen-credentials-and-group-policy-to-cripple-enterprise-defenses","Citrus Ransomware Exploits Stolen Credentials and Group Policy to Cripple Enterprise Defenses","2026-11-12T07:20:19+00:00",{"slug":58,"title":59,"published_at":60},"bluephishing-ai-agent-oauth-consent-abuse-bypasses-password-based-defenses","BluePhishing: AI Agent OAuth Consent Abuse Bypasses Password-Based Defenses","2026-11-11T18:20:43.212+00:00",{"slug":62,"title":63,"published_at":64},"ai-powered-agents-exploiting-aws-credentials-via-webshells-and-ec2-roles","AI-Powered Agents Exploiting AWS Credentials via Webshells and EC2 Roles","2026-11-11T16:20:39.974+00:00",{"slug":66,"title":67,"published_at":68},"ai-model-backdoor-technique-highlights-supply-chain-and-permission-risks","AI Model Backdoor Technique Highlights Supply Chain and Permission Risks","2026-11-11T11:20:39.158+00:00",[70,75,80,85,90,95],{"slug":71,"name":72,"problem":73,"stories":74},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",344,{"slug":76,"name":77,"problem":78,"stories":79},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",231,{"slug":81,"name":82,"problem":83,"stories":84},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",226,{"slug":86,"name":87,"problem":88,"stories":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",224,{"slug":91,"name":92,"problem":93,"stories":94},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",163,{"slug":96,"name":97,"problem":98,"stories":99},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",161,[101,107,112,118,123,128,132,137],{"family":102,"item":103,"code":104,"title":105,"together":106},"cis","6","Control 6","Access Control Management",474,{"family":5,"item":108,"code":109,"title":110,"together":111},"ac-2","AC-2","Account Management",431,{"family":113,"item":114,"code":115,"title":116,"together":117},"gdpr","32","Article 32","Security of processing",396,{"family":102,"item":119,"code":120,"title":121,"together":122},"7","Control 7","Continuous Vulnerability Management",303,{"family":124,"item":125,"code":126,"title":126,"together":127},"itil","overview","ITIL",289,{"family":102,"item":129,"code":130,"title":110,"together":131},"5","Control 5",264,{"family":5,"item":133,"code":134,"title":135,"together":136},"si-2","SI-2","Flaw Remediation",252,{"family":102,"item":138,"code":139,"title":140,"together":141},"8","Control 8","Audit Log Management",237]