Logical security: least privilege, zero trust, MFA methods (authenticator apps, SMS, hardware tokens, email), SSO, MDM, DLP, IAM, directory services, access control lists

Logical security uses software and configuration, rather than locks and walls, to control who can use systems and data. Its starting principle is least privilege: give each user, service and device only the access it needs to do its job, and no more. A receptionist does not need administrator rights; a backup service account does not need to log on interactively. Least privilege limits the damage from mistakes, malware and stolen accounts, because whatever runs under an account can do only what that account can do.