In order to support the least privilege security principle when a resource is transferring within the organization from a production support system…

The principle of least privilege mandates that a user is granted only the minimum access rights and permissions necessary to perform their job. A production support system administrator requires the highest level of permissions, typically "Administrator" privileges, to manage and maintain the production OS. In contrast, a developer's role does not require any direct access to the production OS directory structure; their work should be confined to development and test environments. To enforce least privilege and separation of duties, when the employee transitions to the developer role, their former administrative access to the production system must be completely revoked, changing their privileges from "Administrator" to "No Access."

1. (ISC)² CISSP Official Study Guide

9th Edition. Chapter 14

"Controlling and Monitoring Access

" section "Implementing Access Control." This chapter details the principle of least privilege

stating that access should be limited to what is needed for an assigned job. When a job role changes

access rights must be modified accordingly

which in this case means revoking production administrative rights.

2. NIST Special Publication 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations. Control AC-6

"Least Privilege." The control states

"The organization employs the principle of least privilege

allowing only authorized access for users...which are necessary to accomplish assigned tasks..." This directly supports revoking unnecessary high-level access when a user's tasks change.

3. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM

17(7)

38-47. This foundational academic paper introduces the principle of least privilege. In Section I.A.3

"Principles of Design

" it states

"Every program and every user of the system should operate using the least set of privileges necessary to complete the job." The transition from an administrator to a developer role is a clear application of this principle. DOI: https://doi.org/10.1145/361011.361062