How authorization, least privilege, endpoint hardening, and a scoped incident response protect user accounts and managed devices.
Least privilege grants users and processes only the access needed for an assigned task. NIST defines the principle as restricting privileges to the minimum necessary.
| Control | Boundary |
|---|---|
| Authentication | Establishes who is requesting access |
| Authorization | Determines what an authenticated identity can do |
| Share permission | Controls access through a network share |
| NTFS permission | Controls access to a Windows file or folder |
| Elevation | Grants a process administrative capability when needed |
For suspected malware, isolate the affected endpoint when appropriate, preserve relevant evidence, follow the organization’s incident process, remove or remediate the threat, and verify the system before restoring normal use. Endpoint hardening includes patching, supported security tooling, limited administrative access, and disabling unnecessary services.