Chapter 13 — Identity and access | Bachelor's Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 13 — Identity and access

Lesson map

Lesson 13 published. Map, example, EX037.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 Authentication and authorisation"]
  N2["13.2 Identity-provider logs"]
  N3["13.3 Signs of misuse"]
  N4["13.4 Response"]
  N5["13.5 Evidence and people"]
  N6["13.6 Least privilege"]
  N7["13.7 Retention"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX037"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 Authentication and authorisation"]
  N2["13.2 Identity-provider logs"]
  N3["13.3 Signs of misuse"]
  N4["13.4 Response"]
  N5["13.5 Evidence and people"]
  N6["13.6 Least privilege"]
  N7["13.7 Retention"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX037"]

[Learning outcomes]
    |
    v
[13.1 Authentication and authorisation]
    |
    v
[13.2 Identity-provider logs]
    |
    v
[13.3 Signs of misuse]
    |
    v
[13.4 Response]
    |
    v
[13.5 Evidence and people]
    |
    v
[13.6 Least privilege]
    |
    v
[13.7 Retention]
    |
    v
[Worked example] --> [Exercise EX037]

Learning outcomes

You will (1) explain authentication and authorisation; (2) read identity-provider logs; (3) detect signs of credential misuse; (4) relate identity evidence to people carefully.

13.1 Authentication and authorisation

Authentication checks who an account claims to be (password, token, biometric); authorisation decides what it may do. Both generate logs.

The two produce different evidence. A sign-in log shows that s.kaur's credentials were accepted at 10:02; an access log shows what that session then opened, such as the mailbox where a forwarding rule was created. An investigation needs both to say not only that an intruder got in, but what the intruder could reach and did reach with that account's permissions.

13.2 Identity-provider logs

The university's single sign-on records each sign-in: account, time, source IP, device, result, and whether multi-factor authentication passed.

Each field answers a question. The source IP suggests where the sign-in came from, the device field whether it was a known machine, and the MFA result whether the second factor was met. For the 10:02 sign-in, the foreign IP and an unfamiliar device, combined with an approved push, form the pattern that Leah describes as likely credential theft followed by MFA fatigue.

13.3 Signs of misuse

After the ws-114 phishing, s.kaur's account shows a sign-in at 10:02 from an IP address in a distant country, with MFA approved by a push notification. Unusual location, plus a prompt the user may have approved by habit, suggests stolen credentials and MFA fatigue.

The timing supports the reading: the credentials were submitted at 09:14:30 and the foreign sign-in followed less than fifty minutes later. That gap is long enough for stolen credentials to be collected and passed on, and short enough to tie the two events together. The forwarding rule at 10:05, three minutes after the sign-in, completes a pattern that responders see often after account takeover.

13.4 Response

The security office resets the password, revokes sessions and reviews what the account accessed after 10:02.

Revoking sessions matters because a password reset alone does not end a session that is already signed in; the intruder could keep reading mail. The review after 10:02 found the mailbox forwarding rule created at 10:05, which responders then removed after recording its details. Every step is logged with its time so the investigation can separate the intruder's actions from the cleanup that followed, which also changes the logs.

13.5 Evidence and people

Identity logs show accounts and devices. Concluding that a particular person signed in requires other evidence. Conversely, the account owner is likely the victim here.

The evidence shows a credential used from a foreign IP, which is not consistent with s.kaur being at ws-114 at the time. The likely reading is that she entered her password on the fake page and later approved a push without realizing it came from someone else. Leah's report says this in neutral terms and leaves any judgement about training to the security office.

13.6 Least privilege

Accounts with fewer permissions limit damage after compromise; the investigation notes s.kaur's account had standard student access only.

With standard student access, the account could read its own mail and files and use teaching systems, but not change other users' data or administer servers. That limits the investigation's scope too: Leah checks what the account could reach, which is far less than for a staff administrator. Had the account held wider rights, every system it could touch would need review.

13.7 Retention

Sign-in logs are kept for a limited period; investigations must request them promptly.

If the identity provider keeps sign-ins for thirty days and the incident is discovered on day twenty-five, only five days remain to export them. Grace's office exports the relevant records on the first day of an investigation and stores them with a hash in the case folder. Later questions can then be answered from the export even after the provider has deleted its own copy. The export notes the query used, so the scope of what was saved is clear.

Service accounts

Not every account is a person. Service accounts run scheduled jobs and integrations; their sign-ins follow patterns. Leah learns to separate them in analysis, because a service account signing in at 03:00 every night is normal, while a student account doing so may not be. Each type has its own baseline.

Worked example

Leah builds a short table: 09:14:30 data POSTed to the fake page from ws-114; 10:02 sign-in to s.kaur from a foreign IP with MFA push approved; 10:05 mailbox rule created forwarding messages externally. She describes the sequence and notes that the mailbox rule is a common follow-on action after account takeover.

Synthetic case. The logs are invented.

Errors and limits

IP geolocation is approximate and VPNs change apparent location; treat location as a clue.

Exercises

EX037 — Misuse signs. What suggests s.kaur's credentials were stolen? Rubric: 3 = foreign IP after phishing POST, MFA push approved; 2 = partial; 1 = vague; 0 = none.
EX038 — Response steps. List three response steps. Rubric: 3 = reset password, revoke sessions, review access; 2 = two; 1 = one; 0 = none.
EX039 — Geolocation. Why treat IP location as a clue only? Rubric: 3 = approximate, VPNs; 2 = partial; 1 = exact; 0 = none.

Synthesis

Identity logs reveal account misuse; connect them to people only with further evidence.

Continue studying — chapter 13 of 40

← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →