V2I12P01

Least Privilege and Access Control Principles in Enterprise Network Security: A Comparative Analysis of the United States and Global Practices

Taiwo Justice Olorunlana^1*

Abstract

As cyber threats are becoming more sophisticated and frequent, least-privilege and access control principles form the foundation of contemporary enterprise network security. The focus of enterprises around the world has shifted increasingly toward identity and access management (IAM) models that deemphasize user rights, narrow attack surfaces, and promote continuous monitoring. The following paper has a comparative in-depth analysis of the implementation of the least privilege and modern access-control principles within enterprise environments as practiced in the United States and other regions of the globe. U.S. frameworks such as the National Institute of Standards and Technology (NIST) Special Publications, Zero Trust Architecture (ZTA) models, and federal compliance mandates, e.g., FISMA and FedRAMP, comprise the sources from which the paper draws comparisons with international frameworks, such as the apparent ones: the European Union’s General Data Protection Regulation (GDPR); the International Organization for Standardization/International Electrotechnical Commission 27001 standards; the UK’s National Cyber Security Centre (NCSC) guidelines; and cybersecurity maturity models in other countries of the Asia-Pacific. The literature review synthesizes academic and industry research on least privilege, access control models (RBAC, ABAC, PBAC, and Zero Trust), and identity governance. The study re-emphasizes how cultural, regulatory, and technological differences influence access controls adopted by countries around the world. Findings have revealed that the U.S. leads in implementing zero trust and compliance-driven access controls; however, privacy-centric controls are emphasized in regions such as the EU, as most Asian-Pacific countries prefer national cybersecurity sovereignty. Recommendations are forwarded to harmonize access control strategies worldwide in a world full of emerging threats.

Keywords:

Least privilege, access control, Zero Trust, network security, NIST, ISO 27001, enterprise cybersecurity, RBAC, ABAC, identity governance, global security practices.