Chapter 18 — Reviewing access

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Purpose of reviews"]
  N2["18.2 The access lab"]
  N3["Lab — Reviewing synthetic application access against"]
  N4["18.3 Investigating findings"]
  N5["18.4 Fixing and repeating"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Purpose of reviews"]
  N2["18.2 The access lab"]
  N3["Lab — Reviewing synthetic application access against"]
  N4["18.3 Investigating findings"]
  N5["18.4 Fixing and repeating"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX052"]

[Learning outcomes]
    |
    v
[18.1 Purpose of reviews]
    |
    v
[18.2 The access lab]
    |
    v
[Lab — Reviewing synthetic application access against]
    |
    v
[18.3 Investigating findings]
    |
    v
[18.4 Fixing and repeating]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) run an access review against authoritative records; (2) find leavers and excess rights; (3) report and fix review findings.

18.1 Purpose of reviews

Access drifts over time as people move, leave and receive temporary rights that are never removed. Periodic access reviews compare who has access with who should. Aisha plans a review of Ashfield's core banking access using two authoritative sources: the human resources list showing who works there and in which role, and the role table approved by information owners. Dr. Carrow emphasises that reviews must use authoritative data, not a manager's memory. She schedules the review for the first week of the quarter.

18.2 The access lab

The lab builds a synthetic list of 140 Ashfield accounts with roles, employment status and application access. It finds ten accounts belonging to people who have left but remain active. Among current staff, thirteen hold access beyond their role, and six of those have administrator access they should not. Aisha notes that the leavers are the most urgent, because nobody monitors their activity and their former colleagues would not notice misuse. She shares the three lists with the IT manager and the information owners within an hour, so each owner can confirm or reject the findings in their area.

Lab — Reviewing synthetic application access against HR status and role

"""Review synthetic application access against HR status and role (stdlib only)."""
import random
random.seed(3)
roles = {"teller": {"core"}, "lending": {"core", "loans"}, "finance": {"core", "ledger"}, "it": {"core", "admin"}}
staff = []
for i in range(140):
    role = random.choice(["teller"] * 5 + ["lending"] * 3 + ["finance"] * 2 + ["it"])
    left = random.random() < 0.1
    apps = set(roles[role])
    if random.random() < 0.08:
        apps.add(random.choice(["loans", "ledger", "admin"]))
    staff.append((f"s{i:03d}", role, left, apps))
leavers_active = [s for s in staff if s[2]]
excess = [s for s in staff if not s[2] and s[3] - roles[s[1]]]
admin_excess = [s for s in excess if "admin" in s[3] - roles[s[1]]]
print(f"accounts {len(staff)}; leavers still active {len(leavers_active)}")
print(f"current staff with access beyond role {len(excess)}; of which admin {len(admin_excess)}")

Run with python3 lab_access.py. Verified output:

accounts 140; leavers still active 10
current staff with access beyond role 13; of which admin 6

18.3 Investigating findings

Aisha checks the ten leaver accounts with the IT manager. Most belong to staff who left during a busy period when leaving forms were delayed. Two belong to temporary staff whose contracts ended without notice to IT. For the thirteen excess cases, information owners confirm that most are left over from earlier roles, while two were granted temporarily for a project. She learns that understanding causes points to process fixes, not just account fixes. She writes each cause beside the account in her review notes.

18.4 Fixing and repeating

The ten leaver accounts are disabled the same day. Excess rights are removed after owners confirm, except one justified temporary grant recorded with an end date. Aisha recommends quarterly reviews and the automated leaver process proposed earlier. Dr. Carrow notes that the second review usually finds far fewer issues, which itself is evidence that process changes worked. She plans to compare results after the next review. She records each fix with the date and the person who confirmed it, so the next review can check that nothing has returned since.

Worked example

Aisha reviews 140 synthetic accounts, finds 10 active leavers and 13 staff with excess access (6 with admin), traces causes and sets quarterly reviews.

Synthetic case. Accounts are synthetic; outputs come from lab_access.py.

Errors and limits

Reviews based on managers' memory miss leavers and leftover rights.

Exercises

• EX052 — Active leavers. How many leavers still had active accounts?
  Show marking criteria

  Rubric: 3 = ten;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX053 — Excess access. How many current staff had access beyond their role?
  Show marking criteria

  Rubric: 3 = thirteen;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX054 — Excess admin. How many of them held administrator access?
  Show marking criteria

  Rubric: 3 = six;; 2 = partly correct;; 1 = wrong;; 0 = none.