Least Privilege Is Harder Than You Think

Transcript

1. Least Privilege Is Harder Than You Think ISC2 Türkiye Chartering Chapter Sena Yakut, 2026
2. About Me! Sena Yakut, Senior Security Engineer @Trendyol All links about me
3. The Gap Between Theory and Practice “Each entity must be able to access only the information and resources that are necessary for its legitimate purpose.” - NIST SP 800179 • Sounds simple. Rarely is. • In cloud, "necessary" changes every day. • Not a one-time fix, something you keep working on.
4. What We Think Least Privilege Looks Like The Ideal World • Every identity has exactly the permissions it needs. • Every permission has an owner. • Permissions are continuously reviewed. • Unused access is removed. If reality looked like this, least privilege wouldn't be a conference topic.
5. What Changed? The principle didn't change. The environment did. Then Now Static servers Ephemeral workloads One application Hundreds of microservices A few admins Thousands of identities Manual changes CI/CD deployments Periodic reviews Continuous changes Cloud didn't break least privilege. It multiplied every permission decision.
6. Why Cloud Makes It Harder? Modern cloud environments create more identities, more permissions, and more change than humans can realistically manage.
7. Identity Explosion 2026 2010 Alice Bob Charlie 3 identities Users IAM Roles Lambda ECS Tasks Kubernetes Pods GitHub Actions Terraform Service Accounts AI Agents 3,000+ identities The problem is no longer managing people. It's managing identities.
10. Continuous Change Developer Changes happening continuously: Git Push CI/CD • New IAM Role • Policy Updated Terraform • New Trust Relationship Deploy 09:00 150 roles ↓ 12:00 157 roles ↓ 17:00 165 roles • Temporary Token Issued • Resource Deleted New IAM Role New Resources Your cloud environment changes faster than your permissions are reviewed.
11. Permission Creep Permissions are easy to add. Difficult to remove.
12. Service-to-Service Permissions Modern applications don't have one identity. They have hundreds.
13. Multi-Cloud & SaaS Modern identity is distributed across clouds, platforms, and SaaS.
14. Common Anti-Patterns The mistakes almost every cloud environment makes.
15. AdministratorAccess The fastest way to deploy. The slowest way to secure. Project Deadline Need to quick fix Nobody comes to remove Convenience creates technical debt.
16. Wildcard Policies Makes policies easier to write. Harder to defend. S3:* iam:* ec2:* Wildcards optimize for speed, not least privilege.
17. Shared Roles When many workloads share one identity, accountability disappears.
18. Zombie Permissions Permissions survive long after the workload disappears.
19. The Measurement Problem You can't improve what you can't meaningfully measure.
20. Can You Measure Least Privilege? Most organizations measure permissions. Very few measure risk. Missing Questions Common Metrics • Number of IAM Roles • Who owns this identity? • Can it assume another role? • Number of Policies • Unused Permissions • AdministratorAccess Count • Can it reach sensitive data? • Is this permission justified? Counting permissions is easy. Measuring exposure is hard.
21. Unused ≠ Unnecessary Not every unused permission is a security problem. Unused for 90 days Actually risky ✓ Disaster recovery role Unknown owner ✓ Incident response role Public trust policy ✓ Quarterly process Never reviewed Excessive permissions Measuring exposure is hard.
22. Human & Organizational Factors Technology isn't the hardest part. People are.
23. Developers vs Security Both teams want success. They optimize for different outcomes. Developers Security Ship faster Reduce risk Reduce friction Protect data Meet deadlines Maintain governance Least privilege succeeds only when both sides win.
24. The Ownership Problem Permissions rarely have a clear owner. Questions Reality Who created it? Nobody knows Who uses it? Nobody removes it Who approves changes? Everyone is afraid An identity without an owner is a long-term risk.
25. Practical Approaches Building least privilege as a continuous process, not a one-time project.
26. Start with Visibility, Not Removal You can't reduce what you can't see.
27. Start with Visibility, Not Removal You can't reduce what you can't see.
28. Temporary Access Beats Permanent Access
29. Temporary Access Beats Permanent Access
30. Treat Permissions Like Code If infrastructure is code, permissions should be too.
31. Treat Permissions Like Code
32. Continuously Remove Access
33. Make Identity Lifecycle Automatic Identity lifecycle is security lifecycle.
34. Reframe the Goal Don't ask 'Do we have least privilege?' Ask 'Are we continuously reducing unnecessary access?'
35. ISC2 Türkiye Chartering Chapter 2026 Thank you!