A standard account is a privilege boundary

Lesson map

Lesson 08. Map, example, EX054.

flowchart TD
  U["Everyday account is administrator"] --> P["A process inherits that authority"]
  P --> H["System-wide change becomes possible"]
  H --> C["Separate admin account; everyday account becomes standard"]
  C --> L["The embedded zeros are not rewritten"]

Least privilege is a boundary on authority. It is not a detector.

Logical drawing

standard-user zeros
    FB02, FB04, FB07, FB09
admin secret
    password manager; Leah and the deputy manager
everyday use
    standard
script
    still shows those four zeros

Learning outcomes

After this chapter, you should be able to:

1. Say what an administrator token allows a process to do, in the terms this case uses.
2. Keep the four zeros in the embedded lists even after the prose describes the change.
3. Refuse a detection rate, a written password, or a code-integrity policy the file does not contain.

8.1 The token is the boundary. The matrix is the before picture.

Saltzer and Schroeder's least-privilege principle is that each user and each program should receive only the authority the task needs. On these laptops the relevant split is between an administrator and a standard user. Chapter 2 states the practical consequence Leah cares about: a harmful program opened by an administrator can change the machine, install itself system-wide, or switch protection off. The same program opened by a standard user cannot do those system-wide things. That is a statement about authority, not a statement that the standard account has been proved free of unwanted software.

The third column records the before picture. It is 0 for FB02, FB04, FB07, and FB09, which is why standard user 8/12 is the print. The prose then describes a change made on two evenings. Leah creates a separate administrator account, known to her and to the deputy manager, with the secret kept in the password manager. She changes the everyday accounts to standard users and checks by signing in as the everyday user. No password is written in the book. The deputy manager is not given a name. The script is not run again. Those four zeros remain in the dictionary that the print came from. A note that says the column "now" shows twelve standard users is describing the story, and it must not be typeset as a new listing.

NIST SP 800-83 Rev. 1 is a guide to malware prevention and handling for desktops and laptops. It is not a count of findings at Fenwick. Forrest and colleagues, in 1996, described building a profile of normal process behaviour as a "sense of self." Leah did not install that kind of monitor, and this file has no detection rate. The approved-application practice is also narrower than a platform policy. Volunteers ask; Leah checks the publisher and the source, installs, and may add the application to a short list. Microsoft's application-control documentation describes a different mechanism: a policy the platform applies when a binary is started, often by signature or by hash. No policy file, publisher rule, or hash is in this manuscript. SP 800-53's AC-6 names least privilege in the catalog. Fenwick's change is the account split above. It is not a completed AC-6 assessment.

8.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. The admin secret stays in the password manager and off the page.

Errors and limits

Least privilege shrinks what a process may change. It does not certify that nothing unwanted is present.

Apply

• EX054 — Boundary or detector? A note says the four admin rows were FB02, FB04, FB07 and FB09, that the script now prints standard user 12 of 12, and that a process profile produced a detection rate. What stands?
  Show marking criteria

  Rubric: 3 = the four zeros stand and stay in the embedded lists; the account split stays prose; no password and no deputy's name are added; no monitor and no detection rate are added;; 2 = the print stays 8 of 12;; 1 = one point;; 0 = none.