Chapter 25 — Laboratory I
Lesson map
Lesson 25 published. Map, example, EX073.
flowchart TD
N0["Learning outcomes"]
N1["25.1 The task"]
N2["Lab — Finding permissions beyond job needs"]
N3["25.2 Results"]
N4["25.3 Limitations"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX073"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["25.1 The task"]
N2["Lab — Finding permissions beyond job needs"]
N3["25.2 Results"]
N4["25.3 Limitations"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX073"]
[Learning outcomes]
|
v
[25.1 The task]
|
v
[Lab — Finding permissions beyond job needs]
|
v
[25.2 Results]
|
v
[25.3 Limitations]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX073]
Learning outcomes
You will (1) build a small access-control checker; (2) test least privilege on synthetic role data; (3) report results with limitations.
25.1 The task
Dr Bellini sets a laboratory exercise: write a Python program that reads Fernway's synthetic role definitions and user assignments and finds users whose permissions exceed their job's needs. Lucas defines what each job should need, such as till staff needing sales but not price changes, and compares this with what each user actually has. The program runs offline on synthetic data, so it can be shared with classmates without exposing real accounts. The aim is to practise turning a principle, least privilege, into a repeatable check.
Lab — Finding permissions beyond job needs
# Find permissions beyond job needs (synthetic roles and users).
need = {"till": {"sales"}, "store-manager": {"sales", "rota", "refunds"},
"warehouse": {"picking", "stock-read"}, "buyer": {"stock-read", "price-change"}}
users = {"u01": ("till", {"sales"}), "u02": ("till", {"sales", "price-change"}),
"u03": ("till", {"sales", "price-change"}), "u04": ("store-manager", {"sales", "rota", "refunds"}),
"u05": ("warehouse", {"picking", "stock-read", "db-owner"}), "u06": ("buyer", {"stock-read", "price-change"}),
"u07": ("warehouse", {"picking", "stock-read"})}
found = 0
for u, (job, has) in sorted(users.items()):
extra = has - need[job]
if extra: found += 1; print(f"{u} ({job}) excess: {', '.join(sorted(extra))}")
print(f"{found} of {len(users)} users exceed job needs")
Run with python3 lab_excess.py. Verified output:
u02 (till) excess: price-change
u03 (till) excess: price-change
u05 (warehouse) excess: db-owner
3 of 7 users exceed job needs
25.2 Results
The lab finds three users with excess permissions. Two store staff hold price-change rights left over from a temporary promotion project, and one warehouse user holds database owner rights granted during an urgent fix. Lucas checks with Hannah that the job definitions are right before calling these findings, because an incorrect definition would produce false alarms. Hannah removes the promotion rights the same week and opens a change ticket to replace the database owner right with a narrower role after the developer confirms what the warehouse task needs.
25.3 Limitations
Lucas lists the limits of his checker. It only knows permissions recorded in the export, not those inside applications with their own user lists. Job definitions are simplified and may miss legitimate exceptions. It finds excess, not misuse. He suggests running it monthly and adding a field for approved exceptions with expiry dates, so temporary rights are visible rather than forgotten. Dr Bellini praises the honest limitations section, noting that reviewers trust tools more when their authors say plainly what they cannot do.
Worked example
Lucas writes an offline least-privilege checker, finds three excess permissions, confirms definitions with Hannah and lists the checker's limits.
Synthetic case. Roles and users are synthetic.
Errors and limits
Application-internal permissions are invisible to the checker. Exceptions need expiry to stay honest.
Exercises
- EX073 — Excess found. How many users had excess permissions and why? Rubric: 3 = three: two promotion leftovers and one urgent-fix database owner right;; 2 = three;; 1 = vague;; 0 = none.
- EX074 — Checking definitions. Why confirm job definitions before reporting? Rubric: 3 = wrong definitions cause false alarms;; 2 = accuracy;; 1 = vague;; 0 = none.
- EX075 — Exception field. What improvement did Lucas suggest for exceptions? Rubric: 3 = an approved-exception field with expiry dates;; 2 = expiry;; 1 = vague;; 0 = none.
Synthesis
A simple checker turns least privilege into a repeatable monthly test, if its limits are stated.
Continue studying — chapter 25 of 40
← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →