Chapter 13 — Identity and access

Chapter 13 — Identity and access

Lesson map

Lesson 13 published. Map, example, EX037.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 Life cycle"]
  N2["13.2 Least privilege"]
  N3["13.3 Access review"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX037"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 Life cycle"]
  N2["13.2 Least privilege"]
  N3["13.3 Access review"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX037"]

[Learning outcomes]
    |
    v
[13.1 Life cycle]
    |
    v
[13.2 Least privilege]
    |
    v
[13.3 Access review]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX037]

Learning outcomes

You will (1) manage identities through joiners, movers and leavers; (2) apply least privilege; (3) run a simple access review.

13.1 Life cycle

Sofia maps Elmfield's identity life cycle. Human resources tells IT when someone joins, and accounts are created. When staff move teams, they ask for new access but rarely lose old access. When staff leave, accounts should be disabled on their last day, but the leaver list reaches IT late. She finds four active accounts belonging to leavers. She proposes that HR send leaver notices automatically before the last day and that IT confirm each disablement in a ticket. The movers' old access is a separate gap that her access review in section 13.3 is designed to catch.

13.2 Least privilege

Least privilege means each person has only the access their role needs. Sofia reviews the housing management system and finds that all housing officers can see every tenant's full record, including support needs and safeguarding notes. Only the specialist support team needs those notes. She recommends role-based access that restricts sensitive fields. ISO/IEC 27002:2022 includes guidance on access control and access rights that supports this, and Elmfield's tenants have a strong interest in it. Restricting safeguarding notes to the specialist support team protects tenants whose circumstances could put them at risk if seen widely.

13.3 Access review

Sofia runs Elmfield's first access review for the finance system. She sends each manager a list of their staff's access and asks them to confirm or remove each item. Most respond within a week; two need reminders. Seven access rights are removed. She records the date, reviewer and changes as evidence. She learns that reviews work best when lists are short, clear and sent to people who actually know what their staff do. The seven removed rights show that access had built up over time, which is why the review should be repeated regularly.

Worked example

Sofia fixes the leaver process, restricts sensitive tenant notes by role and runs a finance access review removing seven rights.

Synthetic case. Accounts and reviews are synthetic; ISO/IEC 27002:2022 is real.

Errors and limits

Managers may approve without checking. Role design takes time.

Exercises

• EX037 — Leaver fix. How did Sofia fix late leaver notices? Rubric: 3 = automatic HR notices before last day with ticket confirmation;; 2 = automation;; 1 = vague;; 0 = none.
• EX038 — Sensitive fields. Who should see safeguarding notes? Rubric: 3 = only the specialist support team;; 2 = support team;; 1 = all officers;; 0 = none.
• EX039 — Review outcome. How many access rights did the review remove? Rubric: 3 = seven;; 2 = 7;; 1 = vague;; 0 = none.

Synthesis

Identity governance manages life-cycle transitions, least privilege and periodic review.

Continue studying — chapter 13 of 40

← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →