Deny by Default

A good rule of thumb with access control is to start with the minimum privileged functions required. For example, by default, every application’s user should be denied access to application resources, with only a legitimate user getting permissions to view, access, and modify them.

In addition, security teams should remove admin rights and other elevated privileges, reducing the scope of impact once an attacker obtains a user’s credentials. Session management should also be performed using Just in Time access to eliminate the need for persistent privileges that hackers can quickly obtain.