Applying least privilege requires knowing what access is needed. Start by mapping actual traffic flows:
Enable logging on firewalls and switches to see current communication patterns.
Work with application teams to document required connections.
Build allow-lists based on observed and documented requirements.
Start in monitor mode to catch missed dependencies before blocking.
Enable enforcement gradually, segment by segment.
Default-deny policies enforce least privilege. All traffic is blocked unless explicitly permitted.