What are least privilege, TLS and secure headers?

Definition:

Least privilege limits what a user or service can access, TLS protects data while it travels, and secure headers constrain some browser behaviors. Encryption at rest protects stored data under the storage threat model, but does not prevent an authorized application from exposing it. Security works through several focused controls rather than one universal setting.

Key points:

• Least privilege gives each identity only the access it needs.

• TLS protects data in transit; encryption at rest protects stored data.

• Headers such as CSP and HSTS add browser protections, but do not replace safe application logic.

• Use separate service identities where useful so a compromise of one workload does not grant every application's permissions.

Interview point:

• Explain which threat each control reduces and where its protection ends.