
The principle of least privilege states that anyone and anything should only have access to what it needs to do their job. That includes users, programs and devices, no matter how much authority they have at the company. It keeps access privileges to an absolute minimum, which prevents lateral movement.