Chapter 13 — Identity and access
Lesson map
Lesson 13 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["13.1 Authentication and authorisation"]
N2["13.2 Individual credentials for staff"]
N3["13.3 Devices without users"]
N4["13.4 Account lifecycle"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["13.1 Authentication and authorisation"]
N2["13.2 Individual credentials for staff"]
N3["13.3 Devices without users"]
N4["13.4 Account lifecycle"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX037"]
[Learning outcomes]
|
v
[13.1 Authentication and authorisation]
|
v
[13.2 Individual credentials for staff]
|
v
[13.3 Devices without users]
|
v
[13.4 Account lifecycle]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) distinguish authentication and authorisation; (2) design network access by identity; (3) manage accounts.
13.1 Authentication and authorisation
Authentication establishes who someone is, usually by password plus another factor; authorisation decides what they may do. At the clinics, the shared wireless passphrase authenticates nobody: anyone who knows it, including former staff and visitors who saw it on a whiteboard, is treated the same. Priya explains that network access should depend on identity, so that staff, clinical devices and visitors receive different access, and that leaving staff can be removed without changing a secret shared by everyone else. Authorisation can then be granted per group rather than to everyone at once.
13.2 Individual credentials for staff
Enterprise wireless modes let each staff member authenticate with their own account, checked against a central directory. When someone leaves, disabling their account removes their wireless access as well, and logs record which account connected, which helps investigations. NIST SP 800-153 recommends strong authentication for wireless clients for these reasons. For visitors, a separate guest network with a regularly changed passphrase or a simple registration page is enough, since guests receive only internet access. The guest network is also kept entirely separate from internal zones, so a leaked guest passphrase exposes nothing internal.
13.3 Devices without users
Clinical carts and printers cannot type passwords. They are authenticated using device certificates or, where unsupported, placed on a restricted network that allows only their specific connections. Priya notes that device identity based only on hardware addresses is weak, as chapter 2 explained, so restricted networks for such devices must assume they could be impersonated and limit what they can reach accordingly. This is defence in depth: the network does not fully trust a device it cannot strongly identify. Their allowed destinations are listed explicitly in the needed-flows list.
13.4 Account lifecycle
Accounts must be created when people join, changed when roles change and removed when they leave. Priya finds three accounts at the clinics belonging to staff who left more than a year ago. She recommends a monthly review comparing accounts with the staff list from human resources, with any differences investigated. Administrator accounts receive special attention: they should be separate from everyday accounts, used only when needed and protected with a second factor, since misuse of them could change the network itself.
Worked example
Priya's design gives staff individual wireless accounts, clinical carts a restricted network, visitors a guest network and administrators separate protected accounts.
Synthetic case. Accounts are synthetic.
Errors and limits
A shared secret known by many people cannot be revoked for one person without changing it for all.
Exercises
- EX037 — Shared passphrase weakness. Why can't a shared passphrase remove one leaver's access? Rubric: 3 = everyone shares it; changing affects all;; 2 = shared;; 1 = vague;; 0 = none.
- EX038 — Device identity. How should devices that cannot use passwords be handled? Rubric: 3 = certificates or restricted network limiting reach;; 2 = restricted;; 1 = ignore;; 0 = none.
- EX039 — Stale accounts. What process catches accounts of former staff? Rubric: 3 = monthly comparison with HR staff list;; 2 = review;; 1 = vague;; 0 = none.
Synthesis
Identity-based access lets the network treat people and devices differently and revoke access individually.
Continue studying — chapter 13 of 40
← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →