Course Outline · Beginner Friendly · 2026
This short course teaches you what Least Privilege means and why it protects people, data, and systems. You will learn how giving only what is needed keeps everyone safe. No technical experience needed.
| Item | Details |
|---|---|
| Level | Beginner |
| Duration | 2 weeks · 2–3 hours per week |
| Modules | 3 modules + 1 final project |
| Tools | Pen and paper (a computer is optional) |
| Certificate | Yes, after the final project |
This course contains 3 modules plus a final project.
Learn what Least Privilege means and why it matters.
Explain Least Privilege in simple words.
Learn how to give only what is needed in real systems.
Describe how to apply Least Privilege in a small system.
Learn how banks, schools, and homes use Least Privilege, and how to plan your own.
Create a simple Least Privilege plan for a small project or family.
Choose a small system (for example, a family's devices, a school portal, or a small shop). Write a short plan that explains:
Present your plan to a friend, teacher, or family member. This becomes your portfolio piece.
After this course, you can continue to Introduction to Access Control, where you will learn how to manage who can see and do what in a system.
Least Privilege Fundamentals · Beginner Level · 2026
Welcome to the first module of Least Privilege Fundamentals. This is the start of a very important journey. By the end of this module, you will understand what Least Privilege means and why it protects people, data, and systems.
Have you ever been in a class where everyone was allowed to touch the teacher's desk? Now imagine a class where only the teacher can touch it. Which one feels safer? The second one, of course. That is Least Privilege.
Least Privilege means giving each person only the access they need to do their job. Nothing more. It is one of the most important rules in security.
Think of a hospital. The doctor can enter the medicine room. The cleaner cannot. The cleaner does not need to enter — that is not their job. Giving everyone full access would be dangerous.
In this module, you will learn what Least Privilege means. You will learn why giving too much access is dangerous. You will see real examples in banks, schools, and homes. And you will learn why this idea matters for everyone.
This module is written for complete beginners. You do not need to know any coding. Every new word is explained in very simple language. So relax, read slowly, and let us begin.
YOUR LEARNING JOURNEY IN MODULE 1
=================================
[ Start ]
|
V
What is Least Privilege?
|
V
Why Too Much Access is Dangerous
|
V
Real-World Examples
|
V
The Cost of Too Much Access
|
V
Why Everyone Can Use It
|
V
[ You understand Least Privilege! ]
This module introduces Least Privilege. You will learn what it means, why it matters, and how it protects everyone.
By the end of this module, you will be able to:
You will learn what Least Privilege is, why it matters, and how it protects everyone.
Chidi is a 12-year-old boy who lives in Lagos. He is a helpful student, and his teacher often asks him to run small errands.
One day, the teacher said, "Chidi, please go to the store room and bring me a box of chalk."
Chidi ran to the store room. The door was open. He walked in and saw shelves full of chalk, exercise books, footballs, cleaning supplies, and even some money bags.
Chidi took a box of chalk and returned to the teacher.
Later that day, the teacher noticed that some money was missing from the store room. She called Chidi.
"Chidi, when you went to the store room, did you see anyone else there?"
"No, ma. But the door was open. Anyone could have entered."
The teacher frowned. "That is the problem. The store room should be locked. Only the storekeeper should have the key. Students should only be allowed to receive items from the storekeeper, not enter the store room themselves."
Chidi understood. "So I had too much access?"
"Yes," the teacher said. "You only needed chalk. But you had access to everything. That is dangerous. From now on, only the storekeeper will enter the store room. Others will wait at the door."
The next week, a new lock was installed. The storekeeper had the only key. Chidi and other students waited outside. If they needed something, the storekeeper brought it.
The money stayed safe. Nothing was stolen again.
Chidi learned a big lesson. Giving people only what they need keeps everyone safe. That is Least Privilege.
CHIDI AND THE STORE ROOM
========================
Before:
[ Open door ] -> [ Anyone can enter ]
-> [ Too much access ]
-> [ Money stolen ]
After:
[ Locked door ] -> [ Only storekeeper has key ]
-> [ Least Privilege ]
-> [ Everything safe ]
Chidi entered a store room and saw everything because everyone had access. Money was stolen. The teacher fixed it by giving only the storekeeper a key. This is Least Privilege. This story introduces the whole module.
In this section, you will go through 12 short lessons. Each lesson teaches one big idea. Each lesson ends with a mini summary. Read slowly. Think about the examples. Ask questions. That is how you learn.
Least Privilege means giving each person only the access they need to do their job. Nothing more.
If someone has more access than they need, a mistake or attack can cause more damage.
Think of a school. The head teacher has keys to every room. A student only has access to their classroom. Students do not need keys to the staff room.
A bank teller can help customers. They cannot access the bank's main vault.
A student can check their own results. They cannot change anyone's scores.
Your younger brother can watch TV. He cannot change the family bank account.
A POS operator can collect payments. They cannot access the owner's full bank account.
LEAST PRIVILEGE =============== [ Head Teacher ] -> All rooms [ Teacher ] -> Classroom + Staff Room [ Student ] -> Classroom only [ Visitor ] -> Front gate only Each has only what they need.
Least Privilege means giving each person only the access they need. Nothing more.
Access means being able to see, use, or change something.
Understanding access helps you control who can do what.
Think of a classroom. Only the teacher can open the cupboard. Students can open their own bags. Each has a different kind of access.
A bank worker can see customer balances, but cannot change them.
A teacher can see results, but only the head teacher can approve them.
Your mother can change the family bank PIN. You cannot.
A bank manager can approve loans. A teller cannot.
TYPES OF ACCESS =============== [ See ] -> read only [ Change ] -> edit [ Delete ] -> remove [ Create ] -> add new [ Admin ] -> give access to others Each is different.
Access means being able to see, use, or change something. There are different kinds of access.
Too much access means having more power than you need. It is dangerous.
If someone has too much access, a mistake or attack can cause more damage.
Think of a janitor with a master key. If the key is lost, every room is at risk.
A bank teller with vault access could steal a lot of money.
A student with score-changing access could cheat.
A family member with full bank access could lose all savings.
An employee with full account access could commit fraud.
TOO MUCH ACCESS
===============
[ One master key ]
|
V
[ If lost, all rooms at risk ]
[ One admin account ]
|
V
[ If hacked, all data at risk ]
Too much access is dangerous. Mistakes or attacks cause more damage.
Least Privilege matters because it reduces the damage from mistakes and attacks.
Even good people make mistakes. Least Privilege limits the harm.
Think of a car. Only the driver can start the engine. Passengers cannot. That is Least Privilege for safety.
A bank limits access so one mistake cannot empty the vault.
A school limits access so no student can change results.
Your family limits access to the bank account.
Nigerian banks limit access to protect customer money.
WHY IT MATTERS
==============
[ Least Privilege ]
|
V
[ Limited access ]
|
V
[ Less damage from mistakes or attacks ]
|
V
[ Safer system ]
Least Privilege matters because it reduces the damage from mistakes and attacks.
Least Privilege is not only for computers. It is used in banks, hospitals, schools, and homes.
Seeing real examples helps you understand and remember Least Privilege.
Think of an airport. Only pilots enter the cockpit. Only cleaners enter the cleaning rooms. Everyone has their own access.
An airport gives pilots access to the cockpit. Passengers stay in their seats.
A school gives teachers access to the staff room. Students wait outside.
Your family gives parents access to the safe. Children do not.
Nigerian banks give managers access to the vault. Tellers do not.
REAL-WORLD EXAMPLES =================== Banks: Tellers -> customer area only Hospitals: Cleaners -> corridors only Schools: Students -> classrooms only Airports: Passengers -> cabin only Homes: Children -> shared rooms only
Least Privilege is used in banks, hospitals, schools, airports, and homes.
The cost of too much access is the harm caused when someone has more power than they need.
Too much access can cost money, data, trust, and even lives.
Think of a doctor who can prescribe any medicine. If they make a mistake, the patient could die. Limits reduce this risk.
A company loses millions because one employee had full access.
A school loses trust when one student changes results.
A family loses savings when one member has full bank access.
Nigerian businesses lose money to insider fraud.
COST OF TOO MUCH ACCESS
=======================
[ Full access ]
|
V
[ One mistake or attack ]
|
V
[ Money lost ]
[ Data lost ]
[ Trust broken ]
Too much access costs money, data, and trust. Least Privilege prevents this.
Least Privilege is part of daily life. Every time you limit access, you are using it.
Understanding daily examples helps you see the idea everywhere.
Think of your phone. Only you have the PIN. Your friend can call, but not open your bank app. That is Least Privilege.
A student uses their own laptop password.
A student can see their own report card, not their friend's.
Your parents can open the family safe. Children cannot.
A Nigerian parent gives the house key to adults, not small children.
DAILY LIFE ========== Phone PIN -> Only you Bank PIN -> Only you Wi-Fi password -> Family only House key -> Family only Laptop password -> Only you
Least Privilege is part of daily life. Every limit on access is a form of it.
Everyone means students, parents, teachers, traders, and businesses. Least Privilege protects all of them.
Everyone has something to protect — money, data, privacy, or reputation.
Think of a student protecting their homework. They keep it in their own bag, not in a shared bag.
A student keeps their homework in a private folder.
A teacher keeps exam papers in a locked cupboard.
Your family keeps money in a bank and in a safe.
A Nigerian trader keeps cash in a safe and in a bank.
EVERYONE BENEFITS ================= Students: Protect homework Parents: Protect money Teachers: Protect exams Traders: Protect sales Businesses: Protect data
Everyone should use Least Privilege. It protects what matters to each person.
Access should match the job means a person should only have the access their job requires.
If access does not match the job, problems happen.
Think of a cleaner in a school. They clean the corridor. They should not have access to the exam cupboard. Their job does not need it.
A bank teller has access to cash drawers. They do not have access to the vault.
A student has access to their own grades. Not the whole school's grades.
Your mother has access to the cooking gas. Your younger brother does not.
A Nigerian bank manager has access to the vault. A new employee does not.
MATCH ACCESS TO JOB =================== Cleaner: Cleaning rooms Teacher: Teaching rooms Head Teacher: All rooms Student: Classrooms
Access should match the job. Give only what is needed for the role.
Removing access means taking away access when a person no longer needs it.
Old access can become a weakness. If someone leaves a role, their access should be removed.
Think of a former student. They should not still be able to log into the school portal.
A bank removes a former employee's access on their last day.
A school removes a former student's portal access after graduation.
Your family changes the Wi-Fi password after a helper leaves.
Nigerian banks remove access immediately when staff leave.
REMOVING ACCESS
===============
[ Person leaves role ]
|
V
[ Remove access ]
|
V
[ No old access remains ]
|
V
[ System stays safe ]
Removing access means taking it away when a person no longer needs it.
Reviewing access means checking who has access and whether they still need it.
Access can grow over time. Regular reviews keep it correct.
Think of cleaning your room. You check what you have and remove what you do not need. Access reviews are the same.
A bank reviews user access every month.
A school reviews portal access every term.
Your family reviews who has the Wi-Fi password every year.
Nigerian banks review access regularly to prevent fraud.
REVIEWING ACCESS
================
[ List users ]
|
V
[ List access ]
|
V
[ Check if needed ]
|
V
[ Remove unneeded ]
|
V
[ Repeat regularly ]
Reviewing access means checking who has access and whether they still need it.
A Least Privilege thinker is someone who always asks, "Does this person really need this access?"
This habit protects you, your family, and your projects.
Think of a careful guard. They only let people into areas they need to enter. A Least Privilege thinker does the same with access.
A student asks, "Do I really need to share my password?"
A student helps the teacher limit access to the portal.
Your family checks who has the Wi-Fi password.
A Nigerian family limits who can access the bank account.
BECOMING A THINKER
==================
[ Ask "who needs this access?" ]
|
V
[ Give only what is needed ]
|
V
[ Remove when not needed ]
|
V
[ Review often ]
|
V
[ Teach others ]
A Least Privilege thinker always asks, "Does this person really need this access?" Anyone can become one.
| Word | Simple Definition |
|---|---|
| Least Privilege | Give each person only what they need. |
| Access | Being able to see, use, or change something. |
| Too Much Access | Having more power than needed. |
| Role | The job or position someone has. |
| Remove Access | Take away access when not needed. |
| Review Access | Check who has access and why. |
| Admin | Highest level of access. |
| Read | See only, no changes. |
| Write | Change or add. |
| Thinker | Someone who asks good questions. |
These words are the foundation of Least Privilege. Use them often so they become easy.
Each person should only have the access their job requires.
More access means more risk from mistakes or attacks.
Old access becomes a weakness. Remove it.
Access grows over time. Reviews keep it correct.
Students, parents, teachers, and businesses all benefit from Least Privilege.
These five concepts are the heart of Module 1. Read them again before moving on.
APPLYING LEAST PRIVILEGE
========================
[ Who uses it? ]
|
V
[ What is their job? ]
|
V
[ What access is needed? ]
|
V
[ Give only that ]
|
V
[ Remove when roles change ]
|
V
[ Review regularly ]
SPOTTING TOO MUCH ACCESS
========================
[ User ]
|
V
[ Needs access? ]
|
V
[ Yes ] -> OK
[ No ] -> Too much access
REVIEWING ACCESS
================
[ List users ]
|
V
[ List access ]
|
V
[ Check if needed ]
|
V
[ Remove unneeded ]
|
V
[ Repeat regularly ]
Applying Least Privilege, spotting too much access, and reviewing access all follow simple steps. Follow them, and your systems stay safe.
A bank gives tellers access to cash drawers. Only managers access the vault.
A hospital gives cleaners access to corridors. Only doctors access medicine rooms.
A school gives students access to their classroom. Only teachers access the staff room.
An online shop gives support staff access to order details. Only owners access the financial dashboard.
A government office gives different access to different departments.
Least Privilege is used in banks, hospitals, schools, shops, and government offices.
Nigerian banks give limited access to different levels of staff.
Paystack and Flutterwave give employees only the access they need.
Nigerian universities give students access to their own results only.
NITDA uses Least Privilege to protect national systems.
Families give the bank PIN only to parents.
Nigeria uses Least Privilege in banks, fintechs, schools, government, and families.
Each player has a role. Only the captain talks to the referee.
Each person has their own lunchbox. No one eats from another's.
Only you open your own pencil case.
Only the builder touches the tower.
Only the player with the controller can move the character.
Least Privilege appears in football teams, lunchboxes, pencil cases, card houses, and video games.
| Situation | Least Privilege |
|---|---|
| Family phone | Each person has own PIN |
| Family bank account | Only parents have access |
| Wi-Fi | Only family knows password |
| House keys | Only adults have keys |
| School portal | Students see own results only |
Even simple daily activities use Least Privilege. Now you can see it everywhere.
Parents can teach Least Privilege at home through daily examples and simple activities.
Least Privilege is powerful and used everywhere.
Least Privilege is full of surprises. The more you learn, the safer you become.
These ten points are the heart of Module 1. Read them again before moving on.
Avoiding these mistakes will make your security stronger than most.
These ten practices will help you apply Least Privilege every day.
LEAST PRIVILEGE =============== [ Head Teacher ] -> All rooms [ Teacher ] -> Classroom + Staff Room [ Student ] -> Classroom only [ Visitor ] -> Front gate only
TYPES OF ACCESS =============== [ See ] [ Change ] [ Delete ] [ Create ] [ Admin ]
TOO MUCH ACCESS
===============
[ One master key ]
|
V
[ All rooms at risk ]
APPLYING LEAST PRIVILEGE
========================
[ Who uses it? ]
|
V
[ What is their job? ]
|
V
[ What access is needed? ]
|
V
[ Give only that ]
|
V
[ Remove when roles change ]
|
V
[ Review regularly ]
REMOVING ACCESS
===============
[ Person leaves role ]
|
V
[ Remove access ]
|
V
[ No old access remains ]
|
V
[ System stays safe ]
BECOMING A THINKER
==================
[ Ask "who needs this access?" ]
|
V
[ Give only what is needed ]
|
V
[ Remove when not needed ]
|
V
[ Review often ]
|
V
[ Teach others ]
These diagrams help you see Least Privilege clearly. Draw them yourself to remember them better.
| Least Privilege | Too Much Access |
|---|---|
| Only what is needed | More than needed |
| Safer | Riskier |
| Limits damage | Amplifies damage |
| Easy to review | Hard to track |
| Role | Access |
|---|---|
| Head Teacher | All rooms |
| Teacher | Classroom + Staff Room |
| Student | Classroom only |
| Visitor | Front gate only |
| Common Mistakes | Best Practices |
|---|---|
| Everyone has full access | Only what is needed |
| Never remove access | Remove when not needed |
| No reviews | Review often |
| Shared passwords | Separate accounts |
Comparing ideas side by side helps you remember the differences clearly.
| Lesson | Main Idea |
|---|---|
| Lesson 1 | Least Privilege means giving only what is needed. |
| Lesson 2 | Access means being able to see, use, or change. |
| Lesson 3 | Too much access is dangerous. |
| Lesson 4 | Least Privilege matters because it reduces damage. |
| Lesson 5 | Real-world examples of Least Privilege are everywhere. |
| Lesson 6 | Too much access costs money, data, and trust. |
| Lesson 7 | Least Privilege is part of daily life. |
| Lesson 8 | Everyone should use Least Privilege. |
| Lesson 9 | Access should match the job. |
| Lesson 10 | Remove access when not needed. |
| Lesson 11 | Review access often. |
| Lesson 12 | Anyone can become a Least Privilege thinker. |
Congratulations! You have completed Module 1. Let us review what you have learned.
You began by learning that Least Privilege means giving each person only the access they need.
You discovered what access is — being able to see, use, or change something.
You learned why too much access is dangerous.
You explored why Least Privilege matters.
You discovered real-world examples in banks, schools, and homes.
You learned the cost of too much access.
You explored Least Privilege in daily life.
You learned why everyone should use it.
You discovered that access should match the job.
You learned to remove access when it is no longer needed.
You explored how to review access often.
Finally, you learned how to become a Least Privilege thinker.
MODULE 1 SUMMARY MAP
====================
[ What is Least Privilege? ]
|
V
[ What is Access? ] -> [ Too Much Access Dangerous ]
|
V
[ Why It Matters ] -> [ Real-World Examples ]
|
V
[ Cost of Too Much ] -> [ Daily Life ]
|
V
[ Everyone Benefits ] -> [ Match Access to Job ]
|
V
[ Remove Access ] -> [ Review Access ] -> [ Thinker! ]
Well done! You now have a strong foundation. In Module 2, you will learn how to apply Least Privilege in real systems.
Least Privilege means giving each person only the access they need. Nothing more.
Access means being able to see, use, or change something.
Because a mistake or attack can cause more damage when someone has too much power.
Because it reduces the damage from mistakes and attacks.
Yes. PINs, keys, and Wi-Fi passwords are all forms of Least Privilege.
Their access should be removed immediately.
Regularly — at least every few months, or after any change.
Yes. Students, parents, teachers, and businesses all benefit.
No. It applies to any system where access matters.
You will learn how to apply Least Privilege in real systems.
| Column A (Word) | Column B (Meaning) |
|---|---|
| 1. Least Privilege | A. Being able to see or change something |
| 2. Access | B. Having more power than needed |
| 3. Too Much Access | C. Give only what is needed |
| 4. Remove Access | D. Check who has access and why |
| 5. Review Access | E. Take away access when not needed |
Answers: 1-C, 2-A, 3-B, 4-E, 5-D
| Column A (Role) | Column B (Access) |
|---|---|
| 1. Head Teacher | A. Classroom only |
| 2. Teacher | B. All rooms |
| 3. Student | C. Front gate only |
| 4. Visitor | D. Classroom + Staff Room |
Answers: 1-B, 2-D, 3-A, 4-C
Matching helps you connect words to meanings quickly.
A small shop uses one password for all staff. Anyone can see everything.
Questions:
A bank has an old employee account that is still active. The employee left two years ago.
Questions:
A school portal lets every student see every other student's results.
Questions:
These scenarios help you apply what you have learned to real situations.
Group size: 3–5 students
Time: 40 minutes
Materials: Paper, pencil
Instructions:
Goal: To practise applying Least Privilege as a team.
Time: 20 minutes
Materials: Notebook, pencil
Instructions:
Goal: To connect Least Privilege to your own life.
Time: 1–2 hours
Materials: Paper, pencil, colour pencils
Instructions:
Goal: To practise designing Least Privilege.
Time: 1 week
Materials: Notebook, pencil
Instructions:
Goal: To see Least Privilege in the real world.
You have finished Module 1. Well done! Here is how to prepare for Module 2, which is all about Applying Least Privilege.
TRANSITION TO MODULE 2
======================
[ Module 1: What is Least Privilege? ]
|
V
[ Module 2: Applying Least Privilege ]
|
V
[ You will learn: users and roles, giving smallest access,
removing old access, and reviewing access ]
See you in Module 2. Keep thinking like a Least Privilege thinker!
End of Module 1 — What is Least Privilege?
⬅ Back to Course Outline | Go to Module 2 ➡
Least Privilege Fundamentals · Beginner Level · 2026
Least Privilege Fundamentals · Beginner Level · 2026
Welcome to Module 2. In Module 1, you learned what Least Privilege means. You learned that it is about giving each person only the access they need. You learned that too much access is dangerous.
Now we go one step further. You will learn how to apply Least Privilege in real systems. You will learn about users and roles. You will learn how to give the smallest access possible. You will learn how to remove old access. And you will learn how to review access regularly.
Think of a market. Each trader has their own stall. Each worker has their own job. Each customer has their own space. No one has more than they need. That is Least Privilege in action.
In this module, you will learn how banks, schools, and businesses apply Least Privilege. You will learn the steps to set up access correctly. And you will learn how to keep it correct over time.
This module is written for complete beginners. You do not need to know any coding. Every new word is explained in very simple language. Every idea comes with examples from real life, school, home, and Nigeria. So relax, read slowly, and let us begin.
YOUR LEARNING JOURNEY IN MODULE 2
=================================
[ Start ]
|
V
Users and Roles
|
V
Giving the Smallest Access
|
V
Removing Access When Not Needed
|
V
Reviewing Access Regularly
|
V
Least Privilege on Devices and Accounts
|
V
[ You know how to apply Least Privilege! ]
This module teaches you how to apply Least Privilege in real systems. You will learn about users, roles, giving smallest access, removing old access, and reviewing access.
By the end of this module, you will be able to:
You will learn how to apply Least Privilege step by step in real systems.
Amina is a 12-year-old girl who lives in Kano. Her mother owns a busy market stall selling grains and spices. It has become very popular, and many workers help every day.
One Saturday, Amina's mother said, "Amina, I want you to help me organise the workers better. Right now, everyone has access to everything, and it is confusing."
Amina was happy to help. She sat down with a notebook and thought carefully.
First, she listed all the workers. There were five: two sellers, one helper, one cashier, and one delivery person.
Next, she listed each person's job. The sellers served customers. The helper arranged goods on the shelves. The cashier collected money. The delivery person carried goods to customers.
Then she matched each job to the access it needed.
"The sellers need to see prices and stock, but not the money box. The helper needs to move goods, but not touch the cash. The cashier needs the money box, but not the supplier list. The delivery person needs the customer addresses, but not the prices."
Her mother was impressed. "You have matched access to each job!"
Finally, Amina said, "And Mama, if anyone leaves, we must remove their access immediately. Also, we should review this every month."
Her mother smiled. "You have planned Least Privilege perfectly."
The next week, they put the plan into action. Each worker had only their own access. The stall became safer and easier to run. No more confusion, no more mistakes.
AMINA'S MARKET PLAN =================== [ Sellers ] -> See prices + stock [ Helper ] -> Move goods [ Cashier ] -> Money box only [ Delivery ] -> Addresses only [ All ] -> Remove access when leaving [ All ] -> Review every month
Amina organised access at her mother's stall by matching access to each job. Each worker had only what they needed. She also planned to remove and review access. This story introduces the whole module.
In this section, you will go through 12 short lessons. Each lesson teaches one big idea. Each lesson ends with a mini summary. Read slowly. Think about the examples. Ask questions. That is how you learn.
A user is a person who uses a system. A role is the job that user does.
Grouping users by role makes it easier to give the right access. Instead of deciding for each person, you decide for each role.
Think of a football team. Each player has a role: goalkeeper, defender, striker. The coach does not tell each player what to do. They tell the role.
A bank has tellers, managers, and admins. Each role has its own access.
A school has students, teachers, and head teachers. Each has its own role.
Your family has parents and children. Each has different access.
A Nigerian bank has different roles for tellers, managers, and admins.
USERS AND ROLES =============== [ Admin ] -> Full access [ Manager ] -> Manage people and data [ Staff ] -> Do their job [ Customer ] -> Use own items [ Visitor ] -> Very limited
A user is a person who uses a system. A role is their job. Roles help you give the right access.
Least Privilege for each role means giving each role only the access its job requires.
Roles are easy to manage. Giving each role just enough access keeps the whole system safe.
Think of a hospital. Doctors have one role. Nurses have another. Cleaners have another. Each role has its own access.
A bank manager can see team performance but not change the vault code.
A teacher can view their students' results but not the whole school's.
Your parents can manage money. Children cannot.
A Nigerian bank gives each role only the access it needs.
LEAST PRIVILEGE FOR ROLES ========================= [ Admin ] -> All access [ Manager ] -> Team + Reports [ Staff ] -> Daily tasks [ Customer ] -> Own account [ Visitor ] -> Public info
Least Privilege for each role means giving each role only the access its job requires.
Giving the smallest access possible means giving just enough access to do the job, no more.
The smaller the access, the smaller the risk.
Think of a student entering a library. They only need to read books. They do not need to move the shelves or take books home without permission.
A bank teller gets access to the cash drawer. Not the vault.
A student gets access to their own grades. Not the whole class's.
Your younger brother gets access to the TV remote. Not the bank app.
A Nigerian POS operator gets access to collect payments. Not to change prices.
SMALLEST ACCESS POSSIBLE
========================
[ Start: no access ]
|
V
[ Add only what is needed ]
|
V
[ No extras ]
|
V
[ Review and remove unused ]
Giving the smallest access possible means giving just enough to do the job, no more.
Different users need different access. A customer needs less access than a manager.
If everyone has the same access, the system is not safe.
Think of a school. Students, teachers, and the head teacher each need different access.
A new bank employee starts with small access. It grows with trust.
A new student gets class access. A class prefect gets a bit more.
A young child can use the family TV. Older children can use a laptop.
A new Nigerian bank employee starts with small access and grows.
ACCESS FOR USERS ================ [ Guest ] -> View only [ New user ] -> Small access [ Experienced ] -> Moderate access [ Manager ] -> Bigger access [ Admin ] -> Full access
Different users need different access. Give each the smallest access they need.
Removing access means taking away access when a person no longer needs it.
Old access becomes a weakness. If someone leaves their role, their access should be removed.
Think of a former student. They should not still be able to log into the school portal.
A bank removes a former employee's access on their last day.
A school removes a former student's portal access after graduation.
Your family changes the Wi-Fi password after a helper leaves.
Nigerian banks remove access immediately when staff leave.
REMOVING ACCESS
===============
[ Person leaves role ]
|
V
[ Remove access ]
|
V
[ No old access remains ]
|
V
[ System stays safe ]
Removing access means taking it away when a person no longer needs it.
Access that expires means access that automatically ends after a certain time.
Expiring access prevents old accounts from becoming weaknesses.
Think of a guest pass at a hotel. It works only for one day. After that, it stops working automatically.
A bank gives a contractor access for one month. After the month, it stops.
A school gives a visiting teacher access for one term.
Your family gives a visitor the Wi-Fi password for one day.
Nigerian banks give temporary staff access that expires.
EXPIRING ACCESS
===============
[ Give access ]
|
V
[ Set expiry date ]
|
V
[ After date, access ends ]
|
V
[ No old access remains ]
Access that expires automatically ends after a set time. This prevents old access from being misused.
Reviewing access means checking who has access and whether they still need it.
Access can grow over time. Regular reviews keep it correct.
Think of cleaning your room. You check what you have and remove what you do not need. Access reviews are the same.
A bank reviews user access every month.
A school reviews portal access every term.
Your family reviews who has the Wi-Fi password every year.
Nigerian banks review access regularly to prevent fraud.
REVIEWING ACCESS
================
[ List users ]
|
V
[ List access ]
|
V
[ Check if needed ]
|
V
[ Remove unneeded ]
|
V
[ Repeat regularly ]
Reviewing access means checking who has access and whether they still need it.
Least Privilege on devices means giving each person only the access they need on a phone, laptop, or tablet.
Devices hold your data. Too much access on a device is dangerous.
Think of a shared phone. You want your own PIN. You do not want your brother to see your messages.
A bank employee has a work phone with only work apps.
A school computer has a student account with only class apps.
Your family uses separate phone accounts for each person.
Nigerian banks give staff separate work profiles on their devices.
LEAST PRIVILEGE ON DEVICES ========================== [ Own PIN ] [ Separate users ] [ App permissions ] [ Guest mode ] [ Child mode ]
Least Privilege on devices means giving each person only the access they need on a device.
Least Privilege on accounts means giving each account only the permissions it needs.
Accounts control what you can do online. Too much access is dangerous.
Think of a school email account. It should only send and receive emails. It should not change school records.
A bank gives admin access only to senior staff.
A school gives portal admin access to only the head teacher.
Your family gives the bank app only to parents.
Nigerian banks give admin accounts to only senior staff.
LEAST PRIVILEGE ON ACCOUNTS =========================== [ Read-only ] [ Edit own files ] [ Admin only for admins ] [ Guest accounts ] [ Service accounts ]
Least Privilege on accounts means giving each account only the permissions it needs.
Least Privilege on networks means giving each device only the network access it needs.
Networks connect devices. Too much network access is dangerous.
Think of a school Wi-Fi. Students should only reach class resources. They should not reach staff records.
A bank uses separate networks for staff and customers.
A school uses separate Wi-Fi for students and staff.
Your family uses a guest Wi-Fi for visitors.
Nigerian banks use separate networks for staff and ATMs.
LEAST PRIVILEGE ON NETWORKS =========================== [ Guest Wi-Fi ] [ Student Wi-Fi ] [ Staff Wi-Fi ] [ Admin Wi-Fi ] [ Separate networks ]
Least Privilege on networks means giving each device only the network access it needs.
Spotting too much access means noticing when someone has more access than they need.
Spotting it helps you fix problems before attackers use them.
Think of a cleaner with a master key. They do not need it. That is too much access.
A bank finds that many employees can access the vault. That is too much access.
A school finds that all students can see all results. Too much access.
Your family finds that everyone knows the bank PIN. Too much access.
A Nigerian business finds that all staff can change prices. Too much access.
SPOTTING TOO MUCH ACCESS ======================== [ Shared password? ] -> Yes -> Problem [ New user admin? ] -> Yes -> Problem [ Old account active? ] -> Yes -> Problem [ Too much access? ] -> Yes -> Fix it
Spotting too much access means noticing when someone has more access than they need.
A Least Privilege implementer is someone who sets up access correctly in real systems.
This skill protects everyone. It prepares you for real work.
Think of a coach who organises the team. A Least Privilege implementer organises access the same way.
A student sets up access for their class project.
A student helps set up safe access for the school portal.
Your family uses your plan for access.
Nigerian cybersecurity professionals set up access every day.
BECOMING AN IMPLEMENTER
=======================
[ Learn users and roles ]
|
V
[ Give smallest access ]
|
V
[ Remove when not needed ]
|
V
[ Review often ]
|
V
[ Teach others ]
A Least Privilege implementer sets up access correctly in real systems. Anyone can become one.
| Word | Simple Definition |
|---|---|
| User | A person who uses a system. |
| Role | The job a user does. |
| Admin | Highest level of access. |
| Manager | Manages people and data. |
| Staff | Does their daily job. |
| Guest | A visitor with limited access. |
| Expiring Access | Access that ends after a set time. |
| Review | Checking access again. |
| Remove | Taking away access. |
| Implementer | Someone who sets up access correctly. |
These words are the foundation of applying Least Privilege. Use them often so they become easy.
Group users by role. Give each role only what it needs.
Start with nothing. Add only what is needed. Remove the rest.
Use expiring access for visitors and temporary staff.
Access grows. Reviews keep it correct.
Apply Least Privilege on devices, accounts, and networks.
These five concepts are the heart of Module 2. Read them again before moving on.
SETTING UP ACCESS
=================
[ List users ]
|
V
[ Group by role ]
|
V
[ Access by role ]
|
V
[ Give only that ]
|
V
[ Set expiry ]
|
V
[ Review regularly ]
SPOTTING TOO MUCH ACCESS
========================
[ User ]
|
V
[ Needs access? ]
|
V
[ Yes ] -> OK
[ No ] -> Too much access
REVIEWING ACCESS
================
[ List users ]
|
V
[ List access ]
|
V
[ Check if needed ]
|
V
[ Remove unneeded ]
|
V
[ Repeat regularly ]
Setting up access, spotting too much access, and reviewing access all follow simple steps. Follow them, and your systems stay safe.
A bank gives tellers access to cash drawers. Managers access the vault. Admins access everything.
A hospital gives doctors access to medicine rooms. Nurses access patient records. Cleaners access corridors only.
A school gives students access to their own results. Teachers access their class results.
An online shop gives support staff order details. Admins access financial reports.
A government office gives different access to each department.
Least Privilege is applied in banks, hospitals, schools, shops, and government offices.
Nigerian banks give different access to different roles.
Paystack and Flutterwave give employees only the access they need.
Nigerian universities give students access to their own results only.
NITDA uses Least Privilege to protect national systems.
Families give the bank PIN only to parents.
Nigeria applies Least Privilege in banks, fintechs, schools, government, and families.
Only the goalkeeper plays in the goal area. Only the captain talks to the referee.
Each person opens only their own lunchbox.
Each student uses their own pencil case.
Only the builder moves the tower.
Only the player with the controller can move the character.
Least Privilege appears in football teams, lunchboxes, pencil cases, card houses, and video games.
| Situation | Least Privilege |
|---|---|
| Family phone | Each person has own PIN |
| Family bank account | Only parents have access |
| Wi-Fi | Guest network for visitors |
| House keys | Only adults have keys |
| School portal | Students see own results only |
Even simple daily activities use Least Privilege. Now you can see it everywhere.
Parents can teach how to apply Least Privilege at home through daily examples.
Least Privilege is powerful and used everywhere.
Least Privilege is full of surprises. The more you learn, the safer you become.
These ten points are the heart of Module 2. Read them again before moving on.
Avoiding these mistakes will make your security stronger than most.
These ten practices will help you apply Least Privilege every day.
USERS AND ROLES =============== [ Admin ] -> Full access [ Manager ] -> Manage people and data [ Staff ] -> Do their job [ Customer ] -> Use own items [ Visitor ] -> Very limited
SETTING UP ACCESS
=================
[ List users ]
|
V
[ Group by role ]
|
V
[ Access by role ]
|
V
[ Give only that ]
|
V
[ Set expiry ]
|
V
[ Review regularly ]
REMOVING ACCESS
===============
[ Person leaves role ]
|
V
[ Remove access ]
|
V
[ No old access remains ]
|
V
[ System stays safe ]
EXPIRING ACCESS
===============
[ Give access ]
|
V
[ Set expiry date ]
|
V
[ After date, access ends ]
REVIEWING ACCESS
================
[ List users ]
|
V
[ List access ]
|
V
[ Check if needed ]
|
V
[ Remove unneeded ]
|
V
[ Repeat regularly ]
BECOMING AN IMPLEMENTER
=======================
[ Learn users and roles ]
|
V
[ Give smallest access ]
|
V
[ Remove when not needed ]
|
V
[ Review often ]
|
V
[ Teach others ]
These diagrams help you see how Least Privilege is applied. Draw them yourself to remember them better.
| Role | Typical Access |
|---|---|
| Admin | Full access, rarely used |
| Manager | Team + reports |
| Staff | Daily tasks |
| Customer | Own account |
| Guest | View only |
| Normal Access | Too Much Access |
|---|---|
| Matched to role | Not matched |
| Reviewed often | Never reviewed |
| Removed when not needed | Left active |
| Safer | Risky |
| Common Mistakes | Best Practices |
|---|---|
| Everyone full access | Only what is needed |
| No removal | Remove when not needed |
| No reviews | Review often |
| Shared accounts | Separate accounts |
Comparing ideas side by side helps you remember the differences clearly.
| Lesson | Main Idea |
|---|---|
| Lesson 1 | Users have roles. Roles have access. |
| Lesson 2 | Give each role only what it needs. |
| Lesson 3 | Give the smallest access possible. |
| Lesson 4 | Different users need different access. |
| Lesson 5 | Remove access when not needed. |
| Lesson 6 | Use expiring access for temporary users. |
| Lesson 7 | Review access regularly. |
| Lesson 8 | Apply Least Privilege on devices. |
| Lesson 9 | Apply Least Privilege on accounts. |
| Lesson 10 | Apply Least Privilege on networks. |
| Lesson 11 | Spotting too much access prevents harm. |
| Lesson 12 | Anyone can become a Least Privilege implementer. |
Congratulations! You have completed Module 2. Let us review what you have learned.
You began by learning about users and roles.
You discovered how to give Least Privilege for each role.
You learned how to give the smallest access possible.
You explored access for different users.
You learned to remove access when it is not needed.
You discovered access that expires.
You explored how to review access regularly.
You learned how to apply Least Privilege on devices.
You discovered how to apply Least Privilege on accounts.
You explored how to apply Least Privilege on networks.
You learned how to spot too much access.
Finally, you learned how to become a Least Privilege implementer.
MODULE 2 SUMMARY MAP
====================
[ Users and Roles ]
|
V
[ Least Privilege for Roles ]
|
V
[ Smallest Access Possible ]
|
V
[ Access for Different Users ]
|
V
[ Remove Access ] -> [ Expiring Access ]
|
V
[ Review Access ]
|
V
[ Devices + Accounts + Networks ]
|
V
[ Spot Too Much Access ]
|
V
[ Implementer! ]
Well done! You now understand how to apply Least Privilege. In Module 3, you will learn how it works in real life and how to plan it yourself.
A user is a person who uses a system.
A role is the job a user does.
Because roles make access easier to manage. You give each role only what it needs.
Start with nothing. Add only what is needed. Remove anything extra.
To prevent old accounts from becoming weaknesses.
Regularly — at least every few months, or after any change.
On devices, accounts, and networks.
Ask "does this person need this access?". If not, they have too much.
Yes. Students, parents, teachers, and businesses all benefit.
You will learn how Least Privilege works in real life and how to plan it yourself.
| Column A (Word) | Column B (Meaning) |
|---|---|
| 1. User | A. Access that ends after a set time |
| 2. Role | B. A person who uses a system |
| 3. Expiring access | C. The job a user does |
| 4. Remove access | D. Check who has access and why |
| 5. Review access | E. Take away access when not needed |
Answers: 1-B, 2-C, 3-A, 4-E, 5-D
| Column A (Role) | Column B (Access) |
|---|---|
| 1. Admin | A. Own account |
| 2. Manager | B. Full access |
| 3. Staff | C. View only |
| 4. Guest | D. Daily tasks |
Answers: 1-B, 2-D, 3-A, 4-C
Matching helps you connect words to meanings quickly.
A small shop uses one password for all staff. Anyone can see everything.
Questions:
A bank has an old employee account that is still active. The employee left two years ago.
Questions:
A school portal lets every student see every other student's results.
Questions:
These scenarios help you apply what you have learned to real situations.
Group size: 3–5 students
Time: 40 minutes
Materials: Paper, pencil
Instructions:
Goal: To practise applying Least Privilege as a team.
Time: 20 minutes
Materials: Notebook, pencil
Instructions:
Goal: To connect Least Privilege to your own life.
Time: 1–2 hours
Materials: Paper, pencil, colour pencils
Instructions:
Goal: To practise designing Least Privilege.
Time: 1 week
Materials: Notebook, pencil
Instructions:
Goal: To see Least Privilege in the real world.
You have finished Module 2. Well done! Here is how to prepare for Module 3, which is all about Least Privilege in Real Life and Planning.
TRANSITION TO MODULE 3
======================
[ Module 2: Applying Least Privilege ]
|
V
[ Module 3: Least Privilege in Real Life and Planning ]
|
V
[ You will learn: Least Privilege in banks, schools, homes,
and how to build your own plan ]
See you in Module 3. Keep thinking like a Least Privilege implementer!
End of Module 2 — Applying Least Privilege
⬅ Back to Course Outline | Go to Module 3 ➡
Least Privilege Fundamentals · Beginner Level · 2026
Least Privilege Fundamentals · Beginner Level · 2026
Welcome to Module 3 — the final module of Least Privilege Fundamentals. You have come a long way. In Module 1, you learned what Least Privilege means. In Module 2, you learned how to apply it in real systems.
Now we come to the last piece of the puzzle. You will learn how Least Privilege is used in real life. You will see how banks, schools, hospitals, and families use it every day. You will also learn how to build your own simple Least Privilege plan.
Think of a builder. They know the materials and the rules. Now they must build a real house. In this module, you will see Least Privilege built into real life.
You will learn how Least Privilege works in banks, schools, and homes. You will see how Nigerian banks protect money. You will see how schools protect records. You will see how families protect their devices. And you will build your own plan.
This module is written for complete beginners. You do not need to know any coding. Every new word is explained in very simple language. Every idea comes with examples from real life, school, home, and Nigeria. So relax, read slowly, and let us begin.
YOUR LEARNING JOURNEY IN MODULE 3
=================================
[ Start ]
|
V
Least Privilege in Banks
|
V
Least Privilege in Schools
|
V
Least Privilege in Homes
|
V
Building a Least Privilege Plan
|
V
Common Mistakes and Best Practices
|
V
[ You are ready to plan Least Privilege! ]
This module teaches you how Least Privilege is used in real life. You will learn about banks, schools, and homes, and how to build your own Least Privilege plan.
By the end of this module, you will be able to:
You will learn how Least Privilege works in real life and how to build your own plan.
Chidi is a 13-year-old boy who lives in Port Harcourt. He has a small delivery business. He delivers food from restaurants to customers. He uses his bicycle and a mobile app his uncle built for him.
One day, Chidi's uncle said, "Chidi, your business is growing. We need to make it safer. Let me show you how Least Privilege works in business."
Chidi was curious. "How, Uncle?"
His uncle explained. "First, every rider should only see the orders they need to deliver. Not all orders. That is Least Privilege."
"Second, each customer should only see their own order. Not other customers' orders."
"Third, the kitchen staff should only see food orders. Not customer addresses."
"Fourth, only you, the owner, should see the money report. Not the riders."
"Fifth, if a rider leaves, we remove their access immediately."
"Sixth, we review all access every month."
Chidi was amazed. All the ideas he had learned about Least Privilege were being used in his small business.
"That is Least Privilege, Chidi," his uncle said. "It works for big banks and small businesses too."
Chidi smiled. He had learned something important. Least Privilege is not just for big companies. It is for everyone — even a boy with a bicycle and a dream.
CHIDI'S DELIVERY BUSINESS ========================= [ Rider ] -> See own orders only [ Customer ] -> See own order only [ Kitchen ] -> See food orders only [ Owner ] -> See money report [ Leaving ] -> Remove access [ Every ] -> Review monthly
Chidi learned that Least Privilege works in real life — even in a small delivery business. His uncle explained how each role gets only the access they need. This story introduces the whole module.
In this section, you will go through 12 short lessons. Each lesson teaches one big idea. Each lesson ends with a mini summary. Read slowly. Think about the examples. Ask questions. That is how you learn.
Least Privilege in banks means giving each employee only the access they need to do their job.
Banks hold people's money. If one person has too much access, the whole bank is at risk.
Think of a bank. The teller serves customers. The manager approves loans. The vault manager opens the vault. Each has only their own access.
A bank teller cannot open the vault. Only the vault manager can.
A school bursar handles fees. Only the head teacher approves large payments.
Only parents can access the family bank app.
Nigerian banks give different access to tellers, managers, and admins.
LEAST PRIVILEGE IN BANKS ======================== [ Teller ] -> Cash drawer [ Manager ] -> Team reports [ Vault Manager ]-> Vault [ Admin ] -> Systems (rarely)
Banks use Least Privilege by giving each employee only the access they need.
Least Privilege in schools means giving each person only the access they need.
Schools hold student records, exam papers, and personal information.
Think of a school. Students see their own results. Teachers see their class results. Head teachers see the whole school's results.
A student cannot change scores. Only teachers can.
A school portal gives each user their own access.
Your family shares the school portal account with parents only.
Nigerian universities give students access to their own results.
LEAST PRIVILEGE IN SCHOOLS ========================== [ Student ] -> Own results [ Teacher ] -> Class results [ Head Teacher ]-> All results [ Parents ] -> Own child [ Visitor ] -> Public info
Schools use Least Privilege by giving each user their own access.
Least Privilege in homes means giving each family member only the access they need.
Families have money, messages, and private data. Least Privilege protects them.
Think of your home. Parents have keys. Children do not. Each has their own access.
A family gives the bank PIN only to parents.
A student uses their own portal password.
Your family uses separate profiles on the family computer.
A Nigerian family gives the house key only to adults.
LEAST PRIVILEGE IN HOMES ======================== [ Parents ] -> Bank app, house key [ Older children ]-> Laptop, phone PIN [ Younger ] -> TV remote [ Guests ] -> Guest Wi-Fi [ Helpers ] -> Work areas only
Families use Least Privilege by giving each member only the access they need.
Least Privilege in businesses means giving each employee only the access they need for their role.
Businesses have money, data, and reputation. Least Privilege protects all three.
Think of a shop. Cashiers work with the till. Managers handle refunds. Owners see the money report.
A small Nigerian shop uses POS machines with limited access for each cashier.
A school canteen gives each worker their own job.
Your family business gives each person their own role.
Nigerian fintechs give employees only the access they need.
LEAST PRIVILEGE IN BUSINESSES ============================= [ Cashier ] -> Till only [ Manager ] -> Reports + refunds [ Owner ] -> Full access [ Support ] -> Order details [ New staff ]-> Small access
Businesses use Least Privilege by giving each employee only the access their role needs.
A Least Privilege plan is a written guide showing who gets what access and why.
A plan keeps you organised and makes reviews easy.
Think of a shopping list. Once it is on paper, you do not forget items. A Least Privilege plan is like that for access.
A bank writes a plan before launching a new app.
A school writes a plan for its portal.
Your family writes a simple plan for online safety.
Nigerian banks document their Least Privilege plans formally.
BUILDING A PLAN
===============
[ List users ]
|
V
[ List roles ]
|
V
[ Access by role ]
|
V
[ Remove what is not needed ]
|
V
[ When to review ]
|
V
[ Who is responsible ]
A Least Privilege plan is a written guide showing who gets what access and why.
Choosing what to give means deciding the smallest access each role needs.
The smaller the access, the smaller the risk.
Think of a hospital. A doctor needs to see patient records. A cleaner does not. Each role has its own access.
A bank teller needs cash drawer access, but not vault access.
A teacher needs class results, not all results.
Your child needs the TV remote, not the bank app.
A Nigerian trader gives each worker access to what they need, nothing more.
CHOOSING WHAT TO GIVE
=====================
[ What is the job? ]
|
V
[ What does it need? ]
|
V
[ Smallest access? ]
|
V
[ Can it be split? ]
|
V
[ Does it need expiry? ]
Choosing what to give means deciding the smallest access each role needs.
Testing your plan means checking if each role has the right access before using it.
A plan that is not tested may fail. Testing finds problems before attackers do.
Think of testing a new lock. You check that only the right key opens it. Your plan is the same.
A bank tests new roles with a small group before launching.
A school tests the portal with a few students first.
Your family tests the new Wi-Fi password on one device first.
Nigerian banks test new features in a safe environment.
TESTING YOUR PLAN
=================
[ Try to access wrong things ]
|
V
[ Check each role ]
|
V
[ Ask a friend ]
|
V
[ Fix problems ]
|
V
[ Test again ]
Testing your plan means checking if each role has the right access before using it.
Keeping the plan alive means updating it regularly as things change.
Roles change. People leave. New staff join. The plan must change too.
Think of a garden. You do not just plant it. You water it, weed it, and protect it. Your plan is the same.
A bank reviews its plan every quarter.
A school updates its portal access every term.
Your family updates access after every change.
Nigerian banks update plans after every staff change.
KEEPING THE PLAN ALIVE
======================
[ Review every 3 months ]
|
V
[ Remove old access ]
|
V
[ Add new access ]
|
V
[ Update plan ]
|
V
[ Teach new staff ]
Keeping the plan alive means updating it regularly as things change.
Teaching others means explaining Least Privilege so everyone can follow it.
A plan works only if everyone follows it.
Think of a class. If everyone knows the rules, no one breaks them.
A bank trains all staff on Least Privilege.
A teacher explains Least Privilege to the class.
A parent teaches the family about access.
Nigerian banks train staff regularly on Least Privilege.
TEACHING OTHERS
===============
[ You learn ]
|
V
[ You teach family ]
|
V
[ They teach friends ]
|
V
[ Community stays safe ]
Teaching others means explaining Least Privilege so everyone can follow it.
Common mistakes are errors people make when applying Least Privilege.
Knowing the mistakes helps you avoid them.
Think of baking a cake. If you forget sugar, it tastes bad. Common mistakes in Least Privilege are like that.
A bank forgets to remove an ex-employee's access. The account is used for fraud.
A school gives all students admin access to the portal.
A family uses the same PIN for everyone.
A Nigerian business forgets to update access after staff changes.
COMMON MISTAKES =============== [ Everyone full access ] [ Shared accounts ] [ No removal ] [ No expiry ] [ No reviews ] [ Admin for daily work ] [ Guests full access ] [ No teaching ]
Common mistakes include giving everyone full access, forgetting removal, and not reviewing.
Best practices are the best ways to apply and maintain Least Privilege.
Best practices keep your system strong and consistent.
Think of a football team. Best practices are like good training habits. They make the team strong.
A bank follows all best practices daily.
A school reviews its portal every term.
Your family follows safe access habits daily.
Nigerian banks follow best practices strictly.
BEST PRACTICES ============== [ Group by role ] [ Smallest access ] [ Match to job ] [ Remove when not needed ] [ Expiring access ] [ Review often ] [ Separate accounts ] [ Admin rare ] [ Teach ] [ Learn ]
Best practices keep Least Privilege strong and consistent. Follow them every day.
A Least Privilege champion is someone who plans and teaches Least Privilege everywhere.
This habit protects you, your family, and your projects. It prepares you for future work.
Think of a careful captain. They plan and teach their team. A champion does the same with access.
A student designs a class project with Least Privilege.
A student helps plan safe access for the school portal.
Your family uses your plan for access.
Nigerian cybersecurity professionals champion Least Privilege daily.
BECOMING A CHAMPION
===================
[ Learn ]
|
V
[ Apply ]
|
V
[ Teach ]
|
V
[ Review ]
|
V
[ Keep learning ]
A Least Privilege champion plans and teaches Least Privilege everywhere. Anyone can become one.
| Word | Simple Definition |
|---|---|
| Least Privilege Plan | A written guide showing who gets what access. |
| Role | The job a user does. |
| Access by Role | Access given based on the job. |
| Smallest Access | Just enough to do the job. |
| Expiring Access | Access that ends after a set time. |
| Review | Checking access again. |
| Remove | Taking away access. |
| Training | Teaching people what to do. |
| Best Practice | A good way of doing something. |
| Champion | Someone who teaches Least Privilege. |
These words are the foundation of Least Privilege planning. Use them often so they become easy.
Banks, schools, homes, and businesses all use Least Privilege.
A written plan keeps you organised and prepared.
Smaller access means smaller risk.
Review and update it regularly.
A plan works only if everyone follows it.
These five concepts are the heart of Module 3. Read them again before finishing the course.
BUILDING A PLAN
===============
[ List users ]
|
V
[ Group by role ]
|
V
[ Access by role ]
|
V
[ Give only that ]
|
V
[ Set expiry ]
|
V
[ Who is responsible ]
|
V
[ Review regularly ]
TESTING YOUR PLAN
=================
[ Try to access wrong things ]
|
V
[ Check each role ]
|
V
[ Ask a friend ]
|
V
[ Fix problems ]
|
V
[ Test again ]
KEEPING THE PLAN ALIVE
======================
[ Review every 3 months ]
|
V
[ Remove old access ]
|
V
[ Add new access ]
|
V
[ Update plan ]
|
V
[ Teach new staff ]
Building, testing, and keeping a plan alive all follow simple steps. Follow them, and your plan stays effective.
A bank uses Least Privilege with roles for tellers, managers, and admins.
A hospital gives doctors, nurses, and cleaners different access.
A school gives students, teachers, and head teachers different access.
An online shop gives support, managers, and owners different access.
A government office gives different access to each department.
Least Privilege is used in banks, hospitals, schools, shops, and government offices.
Nigerian banks use roles to give each staff member only the access they need.
Paystack and Flutterwave give employees only the access they need.
Nigerian universities give students access to their own results only.
NITDA uses Least Privilege to protect national systems.
Families give the bank PIN only to parents.
Nigeria uses Least Privilege in banks, fintechs, schools, government, and families.
Each player has a role. Only the captain talks to the referee.
Each person has their own lunchbox. No one eats from another's.
Only you open your own pencil case.
Only the builder touches the tower.
Only the player with the controller can move the character.
Least Privilege appears in football teams, lunchboxes, pencil cases, card houses, and video games.
| Situation | Least Privilege |
|---|---|
| Family phone | Each person has own PIN |
| Family bank account | Only parents have access |
| Wi-Fi | Guest network for visitors |
| House keys | Only adults have keys |
| School portal | Students see own results only |
Even simple daily activities use Least Privilege. Now you can see it everywhere.
Parents can teach Least Privilege planning at home through daily examples.
Least Privilege is powerful and used everywhere.
Least Privilege is full of surprises. The more you learn, the safer you become.
These ten points are the heart of Module 3. Read them again before finishing the course.
Avoiding these mistakes will make your Least Privilege stronger than most.
These ten practices will help you plan and maintain strong Least Privilege.
LEAST PRIVILEGE IN BANKS ======================== [ Teller ] -> Cash drawer [ Manager ] -> Team reports [ Vault Manager ]-> Vault [ Admin ] -> Systems (rarely)
LEAST PRIVILEGE IN SCHOOLS ========================== [ Student ] -> Own results [ Teacher ] -> Class results [ Head Teacher ]-> All results [ Parents ] -> Own child [ Visitor ] -> Public info
LEAST PRIVILEGE IN HOMES ======================== [ Parents ] -> Bank app, house key [ Older children ]-> Laptop, phone PIN [ Younger ] -> TV remote [ Guests ] -> Guest Wi-Fi [ Helpers ] -> Work areas only
BUILDING A PLAN
===============
[ List users ]
|
V
[ Group by role ]
|
V
[ Access by role ]
|
V
[ Give only that ]
|
V
[ Set expiry ]
|
V
[ Review regularly ]
TESTING A PLAN
==============
[ Try to access wrong things ]
|
V
[ Check each role ]
|
V
[ Ask a friend ]
|
V
[ Fix problems ]
|
V
[ Test again ]
KEEPING THE PLAN ALIVE
======================
[ Review every 3 months ]
|
V
[ Remove old access ]
|
V
[ Add new access ]
|
V
[ Update plan ]
|
V
[ Teach new staff ]
These diagrams help you see Least Privilege in real life. Draw them yourself to remember them better.
| Place | How Least Privilege Works |
|---|---|
| Bank | Roles for tellers, managers, admins |
| School | Roles for students, teachers, head teachers |
| Home | Roles for parents, children, guests |
| Business | Roles for cashiers, managers, owners |
| Before Plan | After Plan |
|---|---|
| No clear roles | Clear roles for everyone |
| Too much access | Only what is needed |
| No expiry | Expiring access used |
| No reviews | Reviews scheduled |
| Common Mistakes | Best Practices |
|---|---|
| Everyone full access | Only what is needed |
| No removal | Remove when not needed |
| No reviews | Review often |
| Shared accounts | Separate accounts |
Comparing ideas side by side helps you remember the differences clearly.
| Lesson | Main Idea |
|---|---|
| Lesson 1 | Banks use roles for each employee. |
| Lesson 2 | Schools use roles for each user. |
| Lesson 3 | Homes use roles for each member. |
| Lesson 4 | Businesses use roles for each employee. |
| Lesson 5 | A plan shows who gets what access. |
| Lesson 6 | Choose the smallest access for each role. |
| Lesson 7 | Test your plan before using it. |
| Lesson 8 | Keep the plan alive with reviews. |
| Lesson 9 | Teaching others makes the plan work. |
| Lesson 10 | Common mistakes weaken your system. |
| Lesson 11 | Best practices keep the plan strong. |
| Lesson 12 | Anyone can become a champion. |
Congratulations! You have completed Module 3. Let us review what you have learned.
You began by learning how Least Privilege works in banks.
You discovered how Least Privilege works in schools.
You learned how Least Privilege works in homes.
You explored Least Privilege in businesses.
You learned how to build a Least Privilege plan.
You discovered how to choose what to give.
You explored how to test your plan.
You learned how to keep the plan alive with reviews.
You discovered how to teach others.
You learned the common mistakes to avoid.
You explored the best practices.
Finally, you learned how to become a Least Privilege champion.
MODULE 3 SUMMARY MAP
====================
[ Least Privilege in Banks ]
|
V
[ Least Privilege in Schools ] -> [ Least Privilege in Homes ]
|
V
[ Least Privilege in Businesses ] -> [ Build a Plan ]
|
V
[ Choose What to Give ] -> [ Test Plan ]
|
V
[ Keep Plan Alive ] -> [ Teach Others ]
|
V
[ Avoid Mistakes ] -> [ Best Practices ] -> [ Champion! ]
Well done! You have completed the entire Least Privilege Fundamentals course. You now understand Least Privilege and how to plan it for real systems.
They give different roles to tellers, managers, and admins. Each role gets only what it needs.
They give students, teachers, and head teachers different access.
They give each family member only the access they need.
They give each employee only the access their role needs.
A written guide showing who gets what access and why.
Look at the role's job and give only the smallest access it needs.
Try to access something you should not. Check each role has the right access.
Review every 3 months, remove old access, add new access, and teach new staff.
Giving everyone full access, using shared accounts, or forgetting to remove old access.
Yes. Learn, apply, teach, review, and keep learning.
| Column A (Place) | Column B (Use) |
|---|---|
| 1. Bank | A. Students see own results |
| 2. School | B. Only parents access bank app |
| 3. Home | C. Cashier uses till only |
| 4. Business | D. Teller accesses cash drawer only |
Answers: 1-D, 2-A, 3-B, 4-C
| Column A (Step) | Column B (Purpose) |
|---|---|
| 1. Choose what to give | A. Find problems |
| 2. Test the plan | B. Give the smallest access |
| 3. Review access | C. Keep the plan useful |
| 4. Teach others | D. Make sure everyone follows |
Answers: 1-B, 2-A, 3-C, 4-D
Matching helps you connect places and steps to their purposes.
A school is launching a new portal. They have not planned Least Privilege.
Questions:
Your family's Wi-Fi is used by everyone, including visitors.
Questions:
A trader is opening an online shop. Everyone shares one password.
Questions:
These scenarios help you apply what you have learned to real situations.
Group size: 3–5 students
Time: 40 minutes
Materials: Paper, pencil
Instructions:
Goal: To practise planning Least Privilege as a team.
Time: 20 minutes
Materials: Notebook, pencil
Instructions:
Goal: To plan Least Privilege for your own life.
Time: 1–2 hours
Materials: Paper, pencil, colour pencils
Instructions:
Goal: To practise building a full Least Privilege plan.
Time: 1 week
Materials: Notebook, pencil
Instructions:
Goal: To see Least Privilege planning in real systems.
You have completed the entire Least Privilege Fundamentals course. Well done! Here is what to do next.
YOUR COURSE JOURNEY
===================
[ Module 1: What is Least Privilege? ]
|
V
[ Module 2: Applying Least Privilege ]
|
V
[ Module 3: Least Privilege in Real Life and Planning ]
|
V
[ You are now a Least Privilege Champion! ] 🎉
Congratulations on completing the course. Keep thinking like a Least Privilege champion, keep learning, and protect yourself and your family.
End of Module 3 — Least Privilege in Real Life and Planning
End of the Least Privilege Fundamentals Course
⬅ Back to Course Outline | ⬅ Back to Module 2
Least Privilege Fundamentals · Beginner Level · 2026