What is the purpose of the least privilege principle in an industrial security context?

• A. To provide maximum access to speed tasks.
• B. To grant users the minimum access necessary to perform their duties, reducing risk.
• C. To ensure all employees have same access.
• D. To limit access to only administrators.

Answer: (B)

Least privilege means giving users only the access they need to do their job. In industrial security, this is crucial because control systems and safety-critical devices can be damaged or cause harm if someone has more access than necessary. By restricting permissions to the minimum required, you limit the potential damage from mistakes, misconfigurations, or a compromised account. It also helps with accountability and simplifies monitoring, since actions are tied to a specific, justified role. Elevations of privilege should be rare and tightly controlled, with proper authorization and auditing.

Giving maximum access would create unnecessary risk, making it easy for errors or malicious actions to affect critical systems. Providing the same access to all employees ignores differences in roles and duties, and restricting access to only administrators would hinder everyday operations for non-admin staff who need regular system access.