ExamWizardzExamWizardz
Start free
Security

What is privilege creep?

Privilege creep is the gradual buildup of access rights beyond what a user's current job needs, usually because old access stays after a role change.

What is privilege creep?

Privilege creep is the slow accumulation of permissions that a person no longer needs. It is also called access creep, permission creep or entitlement creep. It happens because access is granted for a reason and almost never removed. When someone changes jobs or joins a project, new access is added quickly, because they complain if it is missing. Old access stays, because nobody complains about having too much. Every individual grant may have been approved. The problem is the total.

How privilege creep builds up

  • Role changes handled as additions: a transfer adds the new department's groups without removing the old ones.
  • Temporary access with no end date: rights granted for a project, an audit or leave cover stay indefinitely.
  • Copying another user: "give her the same access as Sam" copies Sam's own accumulated access.
  • Nested groups: one group membership quietly grants several others, hiding how much a user really holds.
  • Service and contractor accounts: a service account given extra rights to fix one problem keeps them for years, and contractor accounts outlive their contracts.

Example: three years, four jobs' worth of access

A technician joins the help desk and is given rights to reset passwords for all users. A year later he moves to the server team and becomes a local administrator on every Windows server. During a firewall migration he is added to the firewall administrators group "for two weeks." Nothing is ever removed. His single account can now reset any user's password, sign in to any server and change firewall rules. If it is phished, the attacker gets all three. The same pattern in finance is worse: an employee who can both create vendors and approve payments holds the combination that separation of duties exists to prevent. Nothing breaks along the way, which is why creep usually surfaces only in an audit or after a breach.

How to detect and prevent privilege creep

  • User access reviews: also called recertification or attestation. On a schedule, commonly quarterly for privileged or sensitive access and at least yearly for the rest, managers or resource owners confirm or revoke each person's access. Anything not confirmed is removed. Reviews work best when they highlight differences from a role baseline instead of listing hundreds of entitlements.
  • Role-based access control: grant access by role, so a transfer swaps the old role for the new one instead of stacking them.
  • A movers process: treat a job change, triggered by HR, like a leave followed by a join, with old access removed on the effective date.
  • End dates and just-in-time access: temporary grants expire automatically, and admin rights are activated only when needed.
  • Alerting: Windows logs event 4728 when a member is added to a security-enabled global group and 4732 for a local group, so alerts on privileged groups catch the most dangerous additions as they happen.

Privilege creep vs. privilege escalation and stale accounts

  • Privilege escalation: an attacker or a flaw gains rights that were never granted. Privilege creep is rights that were granted legitimately and never taken away.
  • Stale or orphaned accounts: accounts that should not exist at all, such as a departed employee's login. Creep is an active, legitimate account with too much access.
  • Role explosion: too many narrow roles in an RBAC design. It makes reviews harder and can hide creep, but it is a design problem rather than accumulation.

Privilege creep on the CompTIA Security+ exam

Privilege creep appears under SY0-801 objective 3.2, where identity is treated as part of the security architecture, and under objective 4.5, which covers running identity and access management, including access reviews. The textbook scenario is an employee who changed roles and still holds the old access, often found by an auditor. The control that detects it is a periodic user access review; the controls that prevent it are role-based provisioning and a movers process. Distractors include privilege escalation, mandatory vacation (which can expose fraud but does not systematically find excess access), MFA, DLP and password policy changes, none of which remove access that is no longer needed.

Studying for CompTIA (Security)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, realistic PBQs, and a readiness score. Start free.

Start studying free

Related terms

just-in-time access

Just-in-time (JIT) access grants elevated privileges only when requested for a specific task and removes them automatically after a set time.

offboarding

Offboarding is the process of removing a departing user's access: disabling accounts, revoking sessions, recovering devices and transferring their data.

principle of least privilege

The principle of least privilege is a security rule that gives each user, account or process only the access it needs to do its job, and nothing more.

privilege escalation

Privilege escalation is gaining higher access than granted, either vertically to admin rights or horizontally to another user's data at the same level.

privileged access management

Privileged access management (PAM) is the set of tools and processes that vault, approve, time-limit and record the use of administrator accounts.

RBAC

RBAC (Role-Based Access Control) is a method of restricting access to system resources based on the roles assigned to individual users within an organization.

← Back to the full CompTIA glossary