Applying the most restrictive set of operating system permissions to all application files is an example of what design principle?
-
Least common mechanism Least privilege
-
Least Privilege
-
Separation of duties
-
Weakest link
To solve this question, the user needs to know the different design principles used in system design.
The option that represents the design principle described in the question is:
B. Least Privilege
Explanation:
The principle of least privilege is a design principle in which users, agents, or processes are granted only the necessary permissions to perform their assigned tasks, and no more. This principle is important because it limits the potential damage of a security breach or other security incident. By applying the most restrictive set of operating system permissions to all application files, the system is designed to provide each application with the minimum level of access required to function properly, reducing the potential damage that could occur from a security breach.
Option A, Least common mechanism, is a separate design principle that states that the fewer mechanisms shared by users, the less likely those mechanisms are to be compromised.
Option C, Separation of duties, is a design principle that requires that more than one person be involved in a task to ensure that no single individual has complete control over a process.
Option D, Weakest link, is a design principle that states that security is only as strong as its weakest point. It emphasizes the need to identify and address vulnerabilities in a system to ensure that it is secure overall.
Therefore, the correct answer is:
The Answer is: B. Least Privilege
Least Privilege is the design principle that a subject (user, process, or file) should be granted only the minimum permissions necessary to perform its function — locking down OS file permissions as tightly as possible for an application is a textbook application of this principle. This differs from 'least common mechanism' (minimizing shared resources between subjects) and 'separation of duties' (splitting critical tasks among multiple people/roles).