Chapter 22 — Identity and access management: data and dependencies
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Data sources"]
N2["Lab — Possible shared accounts"]
N3["22.2 Reading the result"]
N4["22.3 Dependencies"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Data sources"]
N2["Lab — Possible shared accounts"]
N3["22.2 Reading the result"]
N4["22.3 Dependencies"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Data sources]
|
v
[Lab — Possible shared accounts]
|
v
[22.2 Reading the result]
|
v
[22.3 Dependencies]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) identify data sources for identity checks; (2) detect possible shared accounts from sign-in records; (3) map dependencies between systems.
22.1 Data sources
Elena's checks rely on several sources: HR's staff list, the office suite account export, its sign-in logs, the finance system's user list and the repairs app's account list. Each has an owner, an update frequency and quirks, such as the finance list using initials rather than full names. She records these details so that combining sources is done carefully, and she agrees with each owner how often she may receive exports and how they will be handled, in line with her written permission.
Lab — Possible shared accounts
"""Flag accounts signed in from two distant sites within ten minutes in synthetic logs - a sign of sharing (stdlib only)."""
log = [("reception", "09:00", "HQ"), ("reception", "09:04", "Depot"), ("jsmith", "09:02", "HQ"), ("repairs1", "08:10", "Depot"),
("repairs1", "08:15", "Van-7"), ("repairs1", "08:16", "Depot"), ("akhan", "10:00", "HQ"), ("akhan", "13:00", "Depot"), ("reception", "12:30", "HQ")]
def mins(t): h, m = t.split(":"); return int(h)*60 + int(m)
flag = set()
by = {}
for a, t, s in sorted(log, key=lambda r: (r[0], mins(r[1]))):
if a in by and by[a][1] != s and mins(t) - by[a][0] <= 10: flag.add(a)
by[a] = (mins(t), s)
print("accounts:", len(by), " flagged as possibly shared:", sorted(flag))
Run with python3 lab_shared.py. Verified output:
accounts: 4 flagged as possibly shared: ['reception', 'repairs1']
22.2 Reading the result
The synthetic sign-in sample shows four accounts. Two are flagged: reception signed in at headquarters and at the depot four minutes apart, and repairs1 signed in at the depot, then from van 7 and back at the depot within six minutes. One person cannot be in two places that quickly, so these accounts are probably shared. Accounts like akhan, signing in at different sites hours apart, are normal. Elena treats the flags as leads to check with managers, not as proof, because location records can be imprecise.
22.3 Dependencies
Systems depend on each other. If the office suite provider is unavailable, staff cannot reach the connected systems either. The finance system sends payment files using a service account whose password is stored on one server; if that password expires, payments stop. The repairs app depends on tablets staying signed in. Elena maps these dependencies so that changes, such as enforcing multi-factor or rotating a service account password, are planned with their knock-on effects in mind and do not interrupt essential services such as paying suppliers.
Worked example
The sign-in check flags reception and repairs1 as possibly shared; managers confirm both are used by several people per shift.
Synthetic case. Accounts, sites and times are synthetic.
Errors and limits
Treating location-based flags as proof of sharing ignores imprecise location records.
Exercises
- EX064 — Flagged accounts. Which accounts does the lab flag as possibly shared? Rubric: 3 = reception and repairs1;; 2 = two;; 1 = akhan;; 0 = none.
- EX065 — Normal pattern. Why is akhan not flagged? Rubric: 3 = different sites hours apart is normal;; 2 = time gap;; 1 = error;; 0 = none.
- EX066 — Service account dependency. What stops if the finance service account password expires? Rubric: 3 = supplier payments;; 2 = payments;; 1 = email;; 0 = none.
Synthesis
Understanding data sources, checking sign-in patterns and mapping dependencies make identity changes safe.
Continue studying — chapter 22 of 40
← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →