Chapter 24 — Identity and access management: controls

Lesson map

Lesson 24 published. Map, example, EX070.

flowchart TD
  N0["Learning outcomes"]
  N1["24.1 Multi-factor control"]
  N2["24.2 Administrator controls"]
  N3["24.3 Groups and reviews"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX070"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["24.1 Multi-factor control"]
  N2["24.2 Administrator controls"]
  N3["24.3 Groups and reviews"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX070"]

[Learning outcomes]
    |
    v
[24.1 Multi-factor control]
    |
    v
[24.2 Administrator controls]
    |
    v
[24.3 Groups and reviews]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX070]

Learning outcomes

You will (1) specify multi-factor, administrator and access-group controls; (2) choose authenticators by role; (3) define review controls.

24.1 Multi-factor control

The control states that every staff account must have multi-factor authentication registered, enforced at the office suite provider for all sign-ins. Elena chooses authenticators by role, following NIST SP 800-63B-4: administrators and finance staff use security keys or passkeys, which resist fake sign-in pages; other staff may use an authenticator app or passkey; repairs operatives use provided security keys. Text message codes are phased out because they can be intercepted or passed to fake sites more easily. Coverage is checked monthly against this rule using the identity report.

24.2 Administrator controls

Administrator access is the most powerful at Greenhill. Elena specifies separate administrator accounts not used for email or browsing, security keys only, and a list of administrators reviewed monthly. She recommends reducing the nine administrator accounts found earlier to those actually needed, with roles limited to specific tasks, such as password resets for the service desk, rather than full control. Every administrator action is logged by the provider and reviewed when anything unusual happens. The IT lead approves any new administrator account in writing, with a stated reason and review date.

24.3 Groups and reviews

Access to systems is given through team groups owned by managers. Joining a group needs the group owner's approval; leaving a team removes membership automatically when HR records the move. Every six months, managers review their groups, confirming each member still needs access. Elena keeps the review short, showing each person's name, groups and last sign-in, so managers can decide quickly. Group-based access with regular reviews keeps least privilege practical for a small organisation. Reviews that are not completed on time are escalated to the manager's director.

Worked example

The control set requires multi-factor for all, security keys for administrators and finance, separate administrator accounts reduced from nine to four, and six-monthly manager reviews of team groups.

Synthetic case. Controls and counts are synthetic; NIST SP 800-63B-4 is a real source.

Errors and limits

Using everyday accounts for administration exposes powerful rights to email and browsing risks.

Exercises

• EX070 — Text code phase-out. Why are text message codes phased out?
  Show marking criteria

  Rubric: 3 = interceptable and easily passed to fake sites;; 2 = weaker;; 1 = cost;; 0 = none.
• EX071 — Admin reduction. How many administrator accounts remain after reduction?
  Show marking criteria

  Rubric: 3 = four, from nine;; 2 = four;; 1 = nine;; 0 = none.
• EX072 — Review content. What does a manager see in a group review?
  Show marking criteria

  Rubric: 3 = name, groups and last sign-in per person;; 2 = names;; 1 = passwords;; 0 = none.

Synthesis

Role-appropriate authenticators, tightly controlled administrators and owned, reviewed groups form Greenhill's core controls.

Continue studying — chapter 24 of 40

← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →