What you’ll be able to do
- Draft a least-privilege rule that names subject, action, object, and time window.
- Identify at least two trust boundaries in a warehouse-plus-cloud design.
- Explain why a secure default plus an explicit exception is safer than a wide-open default.
- Layer controls so one failure does not become a complete compromise.
Least privilege is a sentence, not a vibe
Least privilege means each identity gets only the actions it needs on the objects it needs, for only as long as it needs them. For contractor Jordan Hale, that is not “YardOS access.” It is: identity Jordan Hale, action view inbound appointments, object dock 3 at the Oakland warehouse, window this Friday 06:00–14:00, authenticator phishing-resistant MFA, recovery only through Priya. If the work changes, the sentence changes. Privilege that accumulates “just in case” is how shared clipboards are reborn inside cloud roles.
Secure defaults mean the system starts closed. A new TrackPort role should see no shipments until someone adds a customer scope. An API key should be unable to export until export is enabled for a named integration. Open-by-default is convenient on day one and expensive on day one hundred.
Trust boundaries and layers
A trust boundary is a place where identity, network, or data assumptions change. Riverstone has several: the public internet versus the VPN; the VPN versus the warehouse VLAN; YardOS versus the identity provider; a contractor laptop versus a company-managed scanner. Crossing a boundary should require a check that does not depend on the previous check. NIST SP 800-207 describes this as never assuming a session is honest merely because it came from an “internal” address.
Layered controls, sometimes called defense in depth, means one missed check is not the whole incident. Contractor access might require an identity in the right group, a device that passes a health signal, a network path that only reaches YardOS, and an application rule that still refuses exports. If the network path is wrong, the application rule still matters. If the application rule is wrong, the short-lived account still expires Friday afternoon.
- Subject, action, object, condition: write all four.
- Default deny for new roles, keys, and network paths.
- Do not treat VPN membership as authorization to data.
- Give every powerful exception an owner and an expiry.
Worked policy: Friday contractor access
Devon wants to “just add Jordan to the Warehouse-Admins group so the scanner works.” That group can reprint bills of lading and export customer files. A better design creates a Contractor-Dock3 role with view and scan rights, binds it to Jordan’s identity for one day, requires MFA, and logs every export as a break-glass event that Priya must acknowledge. The VPN can place Jordan on a contractor VLAN that cannot reach TrackPort’s admin API.
If someone later asks why Riverstone “has so many controls for one contractor,” the answer is the F1 loss sentence: unauthorized disclosure of customer addresses and unauthorized reprinting of bills of lading. Extra groups are cheaper than that loss. Extra groups without expiry are not cheaper; they are privilege creep.
CHECK YOUR JUDGMENT
A scanner vendor needs two hours of remote support on YardOS. Devon proposes adding the vendor’s shared support account to Warehouse-Admins “because that is what worked last time.” Which policy should Maya recommend instead?
NEXT FIELD LESSON