◇ OpenCyber Academy
Bachelor's · Chapter 13 · English

Chapter 13 — Identity and access

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 13 — Identity and access

Lesson map

Lesson 13 published. Map, example, EX037.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 Identity lifecycle"]
  N2["13.2 Authentication and authorisation"]
  N3["13.3 Multi-factor authentication"]
  N4["13.4 Identity signals"]
  N5["13.5 Legacy protocols"]
  N6["13.6 Controls"]
  N7["13.7 Case decision"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX037"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 Identity lifecycle"]
  N2["13.2 Authentication and authorisation"]
  N3["13.3 Multi-factor authentication"]
  N4["13.4 Identity signals"]
  N5["13.5 Legacy protocols"]
  N6["13.6 Controls"]
  N7["13.7 Case decision"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX037"]

[Learning outcomes]
    |
    v
[13.1 Identity lifecycle]
    |
    v
[13.2 Authentication and authorisation]
    |
    v
[13.3 Multi-factor authentication]
    |
    v
[13.4 Identity signals]
    |
    v
[13.5 Legacy protocols]
    |
    v
[13.6 Controls]
    |
    v
[13.7 Case decision]
    |
    v
[Worked example] --> [Exercise EX037]

Learning outcomes

You will (1) explain identity lifecycle, authentication and authorisation; (2) describe multi-factor authentication and its signals; (3) analyse identity logs for compromise; (4) recommend identity controls.

13.1 Identity lifecycle

Accounts are created when people join, changed when roles change and removed when they leave. Universities have heavy churn each term; stale accounts of graduates are a risk if not disabled.

At Riverton, the student records system feeds the identity provider: enrolment creates an account, a change of course updates group memberships, and graduation starts the alumni period. When that feed fails, accounts drift from reality. Lucas's quarterly check compares active accounts with current enrolment and staff lists, and every account matching neither is sent to its owning team for a decision.

13.2 Authentication and authorisation

Authentication proves identity; authorisation decides what the identity may access. A compromised student account can access that student's mail, files and learning platform.

That is why a student account matters even though it has no administrative rights. With s2047's password, the attacker could read the student's mail, set up forwarding and send phishing that classmates trusted. Authorisation limited the damage to what one student could reach, but that still included other students' marks sent by email, as the privacy chapter shows.

13.3 Multi-factor authentication

MFA requires a second proof. Riverton requires it for staff; for students it is optional. Neither s2047 nor s3310 had enrolled.

Had either student enrolled, the stolen passwords alone would not have been enough at the web sign-in page, since the attacker would also need the second factor from the student's phone. MFA was optional for students because of concerns about support calls and students without smartphones, concerns the university later addressed when it made enrolment compulsory, offering hardware tokens to students without a suitable phone.

13.4 Identity signals

New country or device, impossible travel (two distant locations too close in time), legacy protocols that bypass MFA, and MFA method changes are common signals.

In the campaign, s2047 showed two of them at once: a new country and a legacy protocol. The country was new against a history that contained only the United Kingdom. Each signal alone produces false alarms, such as students on holiday, but combinations are much rarer among genuine users and are worth an analyst's time.

13.5 Legacy protocols

s2047's attacker used a desktop mail protocol that does not support MFA. Even enrolled users could be exposed while such protocols remain enabled.

These protocols send the password directly and have no way to ask for a second factor, so the identity provider either accepts the password alone or blocks the protocol entirely. That is why disabling them was paired with requiring MFA in the case decision: without the first change, the second could be bypassed by any attacker who chose an older mail client.

13.6 Controls

Require MFA for all, disable legacy protocols, and alert on MFA changes and risky sign-ins.

Each control addresses a step in the campaign. MFA stops a stolen password from being enough; disabling legacy protocols removes the route around MFA; alerts on MFA changes catch an attacker who registers their own device; and risky sign-in alerts catch what slips through. Together they make the s2047 sequence much harder to repeat. No single one is enough: MFA without legacy blocking leaves a bypass, and alerts without prevention leave analysts racing an attacker who already has the account.

13.7 Case decision

After the campaign, the university decides to require student MFA and disable legacy mail protocols from next term.

Lucas's worked example on legacy protocol use, described below, informed how the change was rolled out, and the service desk prepared guides for setting up MFA on common phones. Announcing the change a full term ahead gave students time to update old mail apps, and kept the cut-over from coinciding with exam weeks, when support calls would be hardest to handle and students least able to wait.

Graduates and leavers

At the end of each year thousands of students graduate. Their accounts move to a short alumni period and are then disabled. Stale accounts that still work are attractive to attackers because nobody watches them, so the SOC alerts on sign-ins to accounts past their end date.

Worked example

Lucas checks how many students used legacy protocols in the past month: 318 accounts, mostly older mail apps. The service desk contacts them before the change, and the cut-over happens with only 14 support calls.

Synthetic case. Figures and decisions are invented.

Errors and limits

MFA reduces password-only compromise but attackers adapt, for example by tricking users into approving prompts.

Exercises

Synthesis

Identity is central to campus security; lifecycle, MFA and identity signals shape both detection and prevention.

Continue studying — chapter 13 of 40

← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →