The Concept of Least Privilege

The fundamentals are often the most underappreciated part of the job in cyber security. In order to achieve a well-managed, secure environment, there must be focus on limiting exposure to risk by reducing the amount of rights and access provided. This is often described as limiting your threat surface.

Least privilege essentially means to provide access to only what is required for a user to perform their job functions and nothing more. An example is that if a user role is sales, they likely do not require access to any of the data associated with the finance team. Broadly distributed access to shared resources is the easiest way for a ransomware attack to impact a much larger part of the environment.  

A corollary to this, but perhaps the greatest source of risk, is administrative rights to a computer. Admin rights, or more specifically the ability to install software or edit operating system registry settings, should never be directly associated with a user account. Instead, this should require an elevation which challenges for a password and ideally a second factor authentication.