Least Privilege for Humans, Not Just Services

I've been working with Burp Suite for about 3 years now, and my opinions on least privilege have changed more than I expected.

The setup was ordinary: Burp Suite at the edges, OpenSSL doing most of the heavy lifting, and a handful of scripts nobody wanted to own. It worked well until usage roughly doubled over a single quarter.

How we got here

The first symptom was subtle. Nothing failed outright, but least privilege kept drifting in the wrong direction, and every fix seemed to make the next one harder.

Most of the complexity was accidental. Over the years we'd layered three different approaches to least privilege on top of each other, and each one made sense at the time.

How it works

We started by writing down the one rule we actually cared about, then deleted every bit of code that didn't serve it. It's not glamorous, but it works.

Stripped of the project-specific bits, it looks like this:

Content-Security-Policy: default-src 'self';
  script-src 'self' 'nonce-r4nd0m';
  style-src 'self';
  img-src 'self' data:;
  frame-ancestors 'none';
  base-uri 'self'

Nothing about this is clever, and that's the point. Anyone on the team can read it in a minute and know exactly what it does.

A few things that helped along the way:

• Pair on the first few changes so the knowledge doesn't live in one head.
• Make the default the safe choice, not just the documented one.
• Delete dead code aggressively; it's the cheapest refactor there is.
• Write the migration guide before writing the migration.

Trade-offs

The biggest cost was social, not technical. Changing how people think about least privilege takes much longer than changing the code.

There are cases where this falls apart. If your team is very small or your traffic is very spiky, the extra moving parts may not pay for themselves.

Wrapping up

I don't think there's a universal answer here, but I hope this gives you a few ideas to try on your own project. If you do, I'd love to hear how it goes.