I'm studying for CISSP. Is least privilege, need to know and confidentiality all the same thing?
In my book it says "confidentiality is sometimes referred to as the principle of least privilege" and also in the index it has in parenthesis (need to know).
I found this site which claims need to know is an extension to least privilege http://simplicable.com/new/principle-of-least-privilege
And I found this practice question
What is the difference between least privilege and need-to-know?
and the answer given is
A user should have a need-to-know to access particular resources; least privilege should be implemented to ensure she only accesses the resources she has a need-to-know.
though I don't follow the reasoning.