Chapter 13 — Identity and access
Lesson map
Lesson 13 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["13.1 Identity as the perimeter"]
N2["13.2 Multi-factor authentication"]
N3["13.3 Credential exposure reports"]
N4["13.4 Service and supplier accounts"]
N5["13.5 Measuring control effect"]
N6["13.6 Least privilege and reviews"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["13.1 Identity as the perimeter"]
N2["13.2 Multi-factor authentication"]
N3["13.3 Credential exposure reports"]
N4["13.4 Service and supplier accounts"]
N5["13.5 Measuring control effect"]
N6["13.6 Least privilege and reviews"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX037"]
[Learning outcomes]
|
v
[13.1 Identity as the perimeter]
|
v
[13.2 Multi-factor authentication]
|
v
[13.3 Credential exposure reports]
|
v
[13.4 Service and supplier accounts]
|
v
[13.5 Measuring control effect]
|
v
[13.6 Least privilege and reviews]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) explain why credentials are a prime target; (2) connect identity intelligence to controls; (3) handle credential-exposure reports responsibly; (4) recognise multi-factor fatigue and session theft at a conceptual level.
13.1 Identity as the perimeter
Cloud email and remote access mean a valid password can reach clinical systems from anywhere. Valid Accounts (T1078) and Phishing (T1566) often combine: phish the credential, then log in. CTI about credential phishing therefore leads to identity controls, not only email filters.
Amara traces one HSSC phishing report to its likely effect at HCHT: a stolen password used to log in to cloud email from abroad. The recommended actions go to the identity team as well as email administrators, and the report names the sign-in patterns to watch for, so each team knows what it should check.
13.2 Multi-factor authentication
MFA blocks most password-only attacks. Adversaries respond by repeatedly prompting users until one approves, or by stealing session tokens after login. Intelligence that such methods are active in the sector justifies number-matching prompts and conditional access.
Amara drafts the recommendation with the identity team, explaining which methods were seen in the sector and how each change addresses one of them. Number matching makes blind approval of repeated prompts much harder, and conditional access can refuse logins from unmanaged devices. The team plans a staged rollout so that clinical staff on shared workstations are not locked out during a shift.
13.3 Credential exposure reports
Sometimes a partner reports HCHT email addresses and passwords found in a public dump. Handle them as personal data: restrict access, never paste passwords into tickets, force resets via the identity team and inform the data protection officer.
Amara's role is to pass the report on through the agreed channel and record that it was received, not to test whether the passwords still work. The identity team checks the accounts and forces resets; the officer decides whether the exposure must be reported. A short note records the source, the date and the actions taken, without any passwords in it.
13.4 Service and supplier accounts
Shared supplier accounts are hard to attribute and often exempt from MFA. Intelligence about supplier compromise in the sector should trigger a review of these accounts first.
Amara helps compile a list of supplier accounts with their owners, the systems they reach, whether MFA applies and when each was last used. Several accounts have not been used in months and are disabled after checking with their owners. Accounts that must stay shared are restricted to named addresses and logged in more detail, so their use can still be checked.
13.5 Measuring control effect
After acting on intelligence, check whether the risky pattern declined: fewer successful logons from new countries, fewer approved repeated prompts.
Amara compares the four weeks before and after the change, using the same queries and noting any other changes that could explain the difference, such as a holiday period with fewer logins. If the pattern did not decline, the intelligence or the control needs another look. Her short report includes the counts, the period and the limitations, and it goes to the identity team and HSSC's feedback form.
13.6 Least privilege and reviews
Regular access reviews remove accounts of leavers and rights that are no longer needed. Intelligence that attackers in the sector are reusing dormant accounts turns a routine review into a priority: dormant privileged accounts are disabled first, with owners confirming any that must stay.
Amara helps the identity team prepare the list and records each decision. Owners have two weeks to confirm an account is still needed; unconfirmed accounts are disabled and can be restored on request. The review is repeated each quarter, and the number of dormant privileged accounts is tracked as a measure of progress.
Worked example
HSSC warns of a campaign sending fake MFA prompts to health staff. Amara checks sign-in logs with the identity team: one nurse approved a prompt at 02:14 from an unfamiliar location. The account is reset, sessions revoked, and the nurse is contacted kindly rather than blamed. HCHT enables number matching.
Synthetic case. The campaign and sign-in are invented.
Errors and limits
Location data is imprecise; travel and VPNs cause false flags. Blame-free handling keeps staff reporting.
Exercises
- EX037 — Combined techniques. Which two ATT&CK techniques combine in credential phishing followed by login? Rubric: 3 = T1566 and T1078 with order; 2 = names; 1 = one; 0 = none.
- EX038 — Dump handling. List three safe-handling steps for a credential-dump report. Rubric: 3 = restrict access, no passwords in tickets, resets via identity team/inform DPO; 2 = two; 1 = one; 0 = none.
- EX039 — Control check. How can HCHT tell whether number matching helped? Rubric: 3 = measure approved suspicious prompts/successful risky logons before vs after; 2 = vague; 1 = assume; 0 = none.
Synthesis
Treat identity as the perimeter, turn credential intelligence into identity controls and handle exposed credentials as personal data.
Continue studying — chapter 13 of 40
← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →