ISC2 CISSP Practice Question

The principle of least privilege is the BEST approach to address the concern of excessive system access rights. This principle requires that users, processes, and systems are granted the minimum level of access rights necessary to perform their assigned tasks and functions. By implementing least privilege, organizations can significantly reduce their attack surface because even if credentials are compromised, the potential damage is limited to only what that account is authorized to access.

While separation of duties helps prevent fraud by dividing critical functions among different people, it doesn't directly address the issue of excessive access rights. Job rotation is primarily used for fraud detection and cross-training but doesn't limit access capabilities. Access control review is an important periodic process to verify appropriate permissions, but it's not the core principle that governs the initial assignment of rights. The principle of least privilege is the foundational concept specifically targeting the problem of excessive access rights from the beginning.