Privilege separation is a computer security technique that breaks programs up by privileges needed to perform operations to limit access to more sensitive areas. This can be structured natively into an operating system or computer program, or it can also be programmed in, depending on the level of complexity. This is one among many tactics that can prevent external attacks and also minimize the amount of damage caused by such attacks by limiting their penetration into the system.
For computer security reasons, users of computers usually must register or work under a guest account. This allows the computer to assign privileges based on the account level. A guest user might be able to perform basic read and write functions, but no system changes. An administrator account could perform system changes and other significant actions. In privilege separation, different functionalities are kept separate to isolate high security areas.
Programmers can accomplish privilege separation by separating out program processes into privileged and unprivileged categories. All users can access the unprivileged section, but users without privileges cannot go into the other parts of the program. If a hack or virus attempts to attack the program, it may be able to operate freely in the unprivileged segments, but it cannot cross the divide to the privileged areas. Meanwhile, privileged users can communicate back and forth between the segments as necessary.
In computer security, the goal is usually to minimize the amount of time administrative accounts need to be in use. Such accounts can be vulnerable to exploit, and if someone uses them to perform routine, unprivileged tasks, it can create a security hole. One benefit of privilege separation is better distancing, to make such accounts less tempting targets. Administrators can also issue fewer of these accounts because users will not need them to perform low-level activities, and this increases the security of the system by limiting the number of vulnerable accounts.
Information technology personnel can program databases and systems with built-in privilege separation, and they can also encourage employers to adopt programs with this security measure already in place. This, in combination with controlling the types of user accounts issued, can help make a system more secure. It is also important for users to exercise basic precautions like regularly checking passwords, not leaving their computers logged in when they are away from the desk, and shutting down their computers at night unless directed to do otherwise for maintenance and other activities.
