Chapter 5 — Security literacy

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 What IAM protects"]
  N2["5.2 Common threats"]
  N3["5.3 Good basic practice"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 What IAM protects"]
  N2["5.2 Common threats"]
  N3["5.3 Good basic practice"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 What IAM protects]
    |
    v
[5.2 Common threats]
    |
    v
[5.3 Good basic practice]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain what identity and access management protects; (2) describe common identity threats; (3) recognise good basic practice.

5.1 What IAM protects

Identity and access management decides who people are when they sign in and what they are allowed to do. At Greenhill, it protects tenant records from people who should not see them, money in the finance system from misuse and staff email from being taken over. Good IAM means the right people get the right access at the right time, and lose it when they no longer need it. Elena explains this to Greenhill staff using everyday comparisons, such as building keys returned when someone leaves.

5.2 Common threats

The most common identity threats are simple. Passwords are guessed, reused from other websites or captured by fake sign-in pages. Accounts of former staff stay active and can be misused. Shared accounts make it impossible to know who did what. And people sometimes have far more access than their job needs, so a mistake or a compromised account causes more harm. Elena keeps her explanations defensive: she describes what can go wrong and how to prevent it, not how anyone would carry out an attack.

5.3 Good basic practice

Basic good practice covers a lot of risk. Multi-factor authentication makes a stolen password much less useful. Disabling accounts promptly when people leave closes a common gap. Giving everyone their own account keeps actions traceable. Granting access by job and reviewing it regularly limits harm. Using a password manager helps staff create long, unique passwords. NIST SP 800-63B-4 also advises against forcing regular password changes without reason, because they push people towards predictable patterns, which surprises some Greenhill managers. Each practice is explained with a short reason staff can remember.

Worked example

Elena's one-page explainer lists four common identity threats at Greenhill and five basic practices, each in plain language with a building-key comparison.

Synthetic case. The explainer and examples are synthetic.

Errors and limits

Explaining threats by describing attack steps rather than prevention is unnecessary for defenders and unsafe to share.

Exercises

• EX013 — IAM definition. What does IAM decide? Rubric: 3 = who people are and what they may do;; 2 = identity and access;; 1 = passwords only;; 0 = none.
• EX014 — Shared account harm. Why are shared accounts a problem? Rubric: 3 = cannot tell who did what;; 2 = traceability;; 1 = speed;; 0 = none.
• EX015 — Forced changes advice. What does NIST advise about regular forced password changes? Rubric: 3 = avoid them without reason, they encourage predictable patterns;; 2 = avoid;; 1 = require;; 0 = none.

Synthesis

IAM protects people, data and money by giving the right access at the right time and removing it when no longer needed.

Continue studying — chapter 05 of 40

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →