Chapter 13 — Identity and access

Chapter 13 — Identity and access

Lesson map

Lesson 13 published. Map, example, EX037.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 Three steps"]
  N2["13.2 Authenticators"]
  N3["13.3 Lifecycle"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX037"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 Three steps"]
  N2["13.2 Authenticators"]
  N3["13.3 Lifecycle"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX037"]

[Learning outcomes]
    |
    v
[13.1 Three steps]
    |
    v
[13.2 Authenticators]
    |
    v
[13.3 Lifecycle]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX037]

Learning outcomes

You will (1) explain identification, authentication and authorisation; (2) describe account lifecycle; (3) relate them to Greenhill's systems.

13.1 Three steps

Identity and access involve three steps. Identification is claiming to be someone, such as typing a username. Authentication is proving the claim, with a password, passkey or security key. Authorisation is deciding what that person may do once proven. Problems can occur at each step: a shared username breaks identification, a weak password weakens authentication, and excessive group membership breaks authorisation. Elena uses these three words carefully in her reports, because mixing them up leads to fixing the wrong thing.

13.2 Authenticators

NIST SP 800-63B-4 describes kinds of authenticators: something you know, such as a password; something you have, such as a phone or security key; and something you are, such as a fingerprint, used to unlock a device. Multi-factor authentication combines different kinds. Some methods resist phishing better than others: a security key or passkey checks the website it is talking to, while a code typed from a text message can be passed on to a fake site. Elena uses this to rank Greenhill's options.

13.3 Lifecycle

Every account has a lifecycle: created when someone joins, changed when they move role and removed when they leave. HR knows about these events first, so good lifecycle processes start from HR records. At Greenhill, joiners are handled well because people chase IT for access, but movers keep old access and leavers rely on an email from HR that sometimes arrives late. Elena maps the current process step by step, noting who does what and where delays happen, as the basis for later improvements.

Worked example

Elena maps Greenhill's lifecycle: joiners take two days, movers keep old access indefinitely and leavers depend on a late-arriving HR email.

Synthetic case. Processes and timings are synthetic.

Errors and limits

Calling a weak password an authorisation problem leads to fixing permissions instead of authentication.

Exercises

• EX037 — Three steps names. Name the three steps of identity and access. Rubric: 3 = identification, authentication, authorisation;; 2 = two;; 1 = one;; 0 = none.
• EX038 — Phishing-resistant choice. Why is a security key more phishing-resistant than a text code? Rubric: 3 = key checks the website; code can be passed on;; 2 = checks site;; 1 = cheaper;; 0 = none.
• EX039 — Mover problem. What goes wrong for movers at Greenhill? Rubric: 3 = they keep old access indefinitely;; 2 = old access;; 1 = vague;; 0 = none.

Synthesis

Clear use of identification, authentication and authorisation, and a mapped lifecycle, show where identity problems lie.

Continue studying — chapter 13 of 40

← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →