Privilege bracketing
≈ 2 min read
Names in other languages
No names in other languages are held for this entry yet.
Article bodies are English and are not machine-translated. A name in another language is not a translation of the article.
In computer security, privilege bracketing is a temporary increase in software privilege within a process to perform a specific function, assuming those necessary privileges at the last possible moment and dismissing them as soon as no longer strictly necessary, therefore ostensibly avoiding fallout from erroneous code that unintentionally exploits more privilege than is merited. It is an example of the use of principle of least privilege in defensive programming. The principle of least privilege, on which the technique is based, is defined by the U.S. National Institute of Standards and Technology as designing a security architecture "so that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function".
In computer security, privilege bracketing is a temporary increase in software privilege within a process to perform a specific function, assuming those necessary privileges at the last possible moment and dismissing them as soon as no longer strictly necessary, therefore ostensibly avoiding fallout from erroneous code that unintentionally exploits more privilege than is merited. It is an example of the use of principle of least privilege in defensive programming. The principle of least privilege, on which the technique is based, is defined by the U.S. National Institute of Standards and Technology as designing a security architecture "so that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function".
Difference
It should be distinguished from privilege separation, which is a much more effective security measure that separates the privileged parts of the system from its unprivileged parts by putting them into different processes, as opposed to switching between them within a single process.
Example
A known example of privilege bracketing is in Debian/Ubuntu: using the 'sudo' tool to temporarily acquire 'root' privileges to perform an administrative command. A Microsoft Powershell equivalent is "Just In Time, Just Enough Admin".
See also
Privilege revocation (computing)
References
Text derived from https://en.wikipedia.org/w/index.php?oldid=1367469063 under CC BY-SA 4.0; modifications have been made.