Chapter 27 — Identity and access management: verification

Lesson map

Lesson 27 published. Map, example, EX079.

flowchart TD
  N0["Learning outcomes"]
  N1["27.1 Configured versus effective"]
  N2["27.2 Sampling outcomes"]
  N3["27.3 Independent checking"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX079"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["27.1 Configured versus effective"]
  N2["27.2 Sampling outcomes"]
  N3["27.3 Independent checking"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX079"]

[Learning outcomes]
    |
    v
[27.1 Configured versus effective]
    |
    v
[27.2 Sampling outcomes]
    |
    v
[27.3 Independent checking]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX079]

Learning outcomes

You will (1) verify that controls work in production; (2) sample real outcomes; (3) distinguish configured from effective.

27.1 Configured versus effective

A control can be configured correctly yet fail in practice. Multi-factor may be enforced, but an old email app that does not support it might still be allowed by an exception. Elena distinguishes configured, meaning the setting exists, from effective, meaning real sign-ins actually use it. She checks effectiveness by sampling sign-in logs and confirming that each successful sign-in included a second factor, finding a few from an old app exception that is then removed. Both views are reported side by side each month for every key control.

27.2 Sampling outcomes

Verifying every event is impractical, so Elena samples. Each month she takes twenty random sign-ins, all leavers and all administrator actions, and checks each against the controls. Random samples avoid her unconsciously picking easy cases. For leavers, she checks every case because there are few and each matters. Sampling results are recorded with the selection method, so another person could repeat the check and get comparable results. Samples are drawn by a short script using a recorded random seed, and results are kept with the monthly evidence so trends in control effectiveness become visible over time.

27.3 Independent checking

Elena asks Greenhill's external auditor to review her verification method and a sample of evidence. The auditor suggests adding checks for accounts created outside the HR process, such as test accounts set up by suppliers. Elena adds a monthly query for accounts with no HR match created in the last month. Independent checking catches blind spots and adds weight to her conclusions, because the people who design controls are not always best placed to judge whether they work. The auditor's comments are filed with her evidence.

Worked example

Sampling finds three sign-ins without a second factor via an old app exception, which is removed; the auditor's suggestion adds a check for accounts created outside HR.

Synthetic case. Samples, findings and the auditor are synthetic.

Errors and limits

Checking only that a control is configured, not that it is effective, misses exceptions that bypass it.

Exercises

• EX079 — Configured versus effective. What is the difference between configured and effective?
  Show marking criteria

  Rubric: 3 = setting exists vs real sign-ins use it;; 2 = exists vs works;; 1 = same;; 0 = none.
• EX080 — Random sampling reason. Why sample sign-ins randomly?
  Show marking criteria

  Rubric: 3 = avoids picking easy cases;; 2 = bias;; 1 = speed;; 0 = none.
• EX081 — Auditor addition. What check did the auditor suggest?
  Show marking criteria

  Rubric: 3 = accounts created outside HR, such as supplier test accounts;; 2 = outside HR;; 1 = vague;; 0 = none.

Synthesis

Verification checks real outcomes by sampling and benefits from independent review.

Continue studying — chapter 27 of 40

← Chapter 26 (draft) · Course chapter index · Chapter 28 (draft) →