What is a least-privilege access model, and how is it implemented in FOSSE?

• A. Users get only the permissions necessary for their role; implemented via RBAC, MFA for privileged actions, regular access reviews, and separation of duties
• B. Users get full access to everything
• C. Access is granted randomly
• D. Access is only controlled by time of day

Answer: (A)

Least-privilege access means giving each user the minimum set of permissions they need to perform their duties, and nothing more. In FOSSE this is put into practice by using role-based access control to assign permissions based on a user’s role, so individuals don’t get blanket access. For privileged actions, multi-factor authentication is required to verify identity before elevated capabilities are used. Regular access reviews help ensure permissions stay aligned with current responsibilities, and separation of duties prevents one person from both performing and approving sensitive operations, strengthening security and auditability. This approach reduces the risk if credentials are compromised and supports compliance.

The other options miss the protective boundary that least privilege provides: granting full access eliminates the safeguards; random access lacks any control; and time-of-day only doesn’t ensure appropriate permissions or robust security.