Least Privilege and Break-Glass Accounts, Explained: Shrinking the Blast Radius

In this deep dive

• Least privilege: only the permissions an identity needs for its legitimate responsibilities
• Why a stolen ordinary account reaches a small area and a stolen admin account reaches almost everything
• Separate standard and admin accounts for administrators, and least privilege for applications and services
• People who move between roles and collect access, and why keeping old access is a least privilege failure
• Break-glass accounts: two cloud-only accounts, excluded from conditional access, protected with FIDO2 keys, alerting on any sign-in and tested on a schedule
• Microsoft's mandatory MFA for its admin portals, and why password-only emergency accounts no longer work there

This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.