thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Fundamentals & Crypto

Least Privilege vs Need to Know vs Separation of Duties

Least privilege gives users only the permissions necessary for their job, need to know restricts access to specific information even when clearance allows it, and separation of duties splits critical tasks among multiple people so no one person can commit and conceal fraud.

Least Privilege

Full definition
vs

Need to Know

Full definition
vs

Separation of Duties

Full definition
Least PrivilegeNeed to KnowSeparation of Duties
FocusPermissions and rightsSpecific data or informationDivision of critical tasks
QuestionWhat is the minimum access required?Does this job require this specific data?Could one person complete this whole sensitive process alone?
Main threat addressedMisuse and blast radius of compromiseUnnecessary exposure of sensitive dataFraud and collusion
ExampleHelp desk can reset passwords but not edit GPOsA Top Secret cleared analyst still cannot read unrelated projectsOne person creates vendors, another approves payments
Related controlsJust-in-time access, PAMMAC compartmentsDual control, job rotation, mandatory vacation
Remember it

Least privilege limits what you can do, need to know limits what you can see, separation of duties limits what you can do alone.

Exam tip

Fraud prevention scenarios point to separation of duties. Questions about a cleared user being denied specific data point to need to know.

Tested on

More Security Fundamentals & Crypto look-alikes