Which principle dictates that entities should only have the minimum access needed?

• A. Data Confidentiality
• B. Least Privilege
• C. Security Assurance
• D. Masquerade

Answer: (B)

The principle that states entities should only have the minimum access needed is known as the Least Privilege principle. This principle is foundational in information security and governance, as it mitigates potential risks associated with excessive access rights.

When access to data and systems is limited to only what is necessary for users to perform their functions, the risk of unauthorized access or misuse is significantly reduced. For instance, if a user only needs to view data without needing to modify or delete it, restricting that user's access accordingly helps protect sensitive information from accidental or malicious actions.

Implementing the Least Privilege principle is essential for maintaining a secure environment, as it also limits the potential impact in the event of a security breach. If an account is compromised, having minimal access rights restricts what an attacker can do, thereby reducing potential damage.

While Data Confidentiality focuses on protecting sensitive information from unauthorized access, and Security Assurance relates to the confidence that systems are adequately secured against threats, these concepts support the overarching goal of Least Privilege by ensuring proper access controls and protocols. Masquerade, on the other hand, refers to a deceptive practice in cyber security, where an entity pretends to be someone else, and does not pertain to the access principle described in the question.