Chapter 21 — Identity and access management: system models | Bachelor's Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 21 — Identity and access management: system models

Lesson map

Lesson 21 published. Map, example, EX061.

flowchart TD
  N0["Learning outcomes"]
  N1["21.1 Components"]
  N2["21.2 Lifecycle flows"]
  N3["21.3 Weak points"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX061"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["21.1 Components"]
  N2["21.2 Lifecycle flows"]
  N3["21.3 Weak points"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX061"]

[Learning outcomes]
    |
    v
[21.1 Components]
    |
    v
[21.2 Lifecycle flows]
    |
    v
[21.3 Weak points]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX061]

Learning outcomes

You will (1) model Greenhill's identity system as components and flows; (2) describe joiner, mover and leaver flows; (3) find weak points in the model.

21.1 Components

Elena models Greenhill's identity system as components: HR records, the office suite identity provider, the housing system, the finance system, the repairs app, the IT team and line managers. Arrows show information moving between them, such as HR telling IT about a leaver or the provider telling the housing system who has signed in. Drawing the model on one page helps everyone see the whole system at once. It also shows that much of identity management depends on people passing messages, not only on technology.

21.2 Lifecycle flows

Using the model, Elena traces three flows. A joiner flow starts when HR enters a new starter, IT creates an account and the manager requests team access. A mover flow should remove old access when someone changes team, but currently only adds new access. A leaver flow starts with an HR email to IT, who disable the office suite account and then email system owners about other accounts. Each step is marked with who performs it, how long it usually takes and what happens if it is missed.

21.3 Weak points

The model shows weak points clearly. The leaver flow depends on two emails, either of which can be delayed or lost. The mover flow has no removal step at all. The finance system is outside single sign-on, so its accounts are not disabled when the office suite account is. The repairs app uses a shared account. Elena marks each weak point on the diagram with a number and lists it in a table with its likely effect, which becomes the starting point for designing controls in later chapters.

Worked example

Elena's one-page model shows seven components, three lifecycle flows and four numbered weak points, from email-dependent leavers to the shared repairs account.

Synthetic case. Components, flows and weak points are synthetic.

Errors and limits

Modelling only technical systems and leaving out managers and HR misses where most lifecycle delays occur.

Exercises

EX061 — Mover flow gap. What step is missing from the mover flow? Rubric: 3 = removal of old access;; 2 = removal;; 1 = creation;; 0 = none.
EX062 — Leaver dependency. What does the leaver flow depend on? Rubric: 3 = two emails that can be delayed or lost;; 2 = emails;; 1 = automation;; 0 = none.
EX063 — People in model. Why include managers and HR in the model? Rubric: 3 = much identity work is messages between people;; 2 = people;; 1 = style;; 0 = none.

Synthesis

A simple component and flow model exposes where identity processes break.

Continue studying — chapter 21 of 40

← Chapter 20 (draft) · Course chapter index · Chapter 22 (draft) →