View source for Privilege revocation (computing)

'''Privilege revocation''' is the act of an entity giving up some, or all of, the [[Privilege (computing)|privileges]] they possess, or some [[Philosophy:Authority|authority]] taking those (privileged) rights away.

== Information theory ==
Honoring the [[Principle of least privilege]] at a granularity provided by the base system such as [[Sandbox (computer security)|sandbox]]ing of (to that point successful) attacks to an unprivileged user account helps in [[Reliability engineering|reliability]] of computing services provided by the system. As the chances of restarting such a process are better, and other services on the same machine aren't affected (or at least probably not as much as in the alternative case: i.e. a privileged process gone haywire instead).

== Computer security ==
In computing security ''privilege revocation'' is a measure taken by a [[Computer program|program]] to protect the [[Software:System software|system]] against misuse of itself.

Privilege revocation is a variant of [[Privilege separation|privilege separation]] whereby the program terminates the privileged part immediately after it has served its purpose. If a program doesn't revoke privileges, it risks the [[Privilege escalation|escalation of privileges]].

Revocation of privileges is a technique of [[Defensive programming|defensive programming]].

== References ==
*[https://web.archive.org/web/20080827164311/http://www.cesg.gov.uk/products_services/iacs/cc_and_itsec/media/protection-profiles/authpp.pdf Protection Profile for Privilege-Directed Content] Authoriszor Ltd, Ref: Auth_CC/PP/DES/01, Issue 1.3, 22 December 2000
*[http://alum.wpi.edu/~tfraser/Papers/timothy-fraser-2000-1.pdf LOMAC: Low Water-Mark Integrity Protection for COTS Environments] by Timothy Fraser

[[Category:Information theory]]
[[Category:Computer security procedures]]

{{Sourceattribution|Privilege revocation (computing)}}