Chapter 10 — Engineering ethics and safety | Engineering Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 10 — Engineering ethics and safety

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Professional duties"]
  N2["10.2 Authorisation"]
  N3["10.3 Data care"]
  N4["10.4 Change safety"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Professional duties"]
  N2["10.2 Authorisation"]
  N3["10.3 Data care"]
  N4["10.4 Change safety"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Professional duties]
    |
    v
[10.2 Authorisation]
    |
    v
[10.3 Data care]
    |
    v
[10.4 Change safety]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) apply professional duties to identity work; (2) obtain authorisation; (3) handle personal data and changes safely.

10.1 Professional duties

Identity systems decide who can reach records about residents, payments and staff. Engineers working on them owe duties to the public, not only to the client: honesty about risk, staying within competence and refusing to approve unsafe designs. Sana reads the code of conduct of her professional body and notes that it requires her to raise concerns even when that is uncomfortable, such as telling a director that former staff still have access. Professional duties exist precisely for moments when silence would be easier.

10.2 Authorisation

Any security work on council systems requires written permission from someone entitled to give it, stating scope, timing and methods. Sana's authorisation covers reading exports provided by application owners and working in a separate test environment. It does not cover signing in to production systems, testing passwords or trying to bypass controls. If she finds she needs something outside that scope, she stops and asks. Working without authorisation, even with good intentions, can be illegal and can damage trust in the whole project.

10.3 Data care

Account exports contain names, roles and last sign-in times, which are personal data about staff. Sana collects only the fields each check needs, stores files on an encrypted council share with access logged, and deletes them when the check is complete. Where possible, application owners pseudonymise usernames before export. For teaching and testing she uses synthetic data, as in this book. Treating colleagues' data with care is part of earning permission to work with it again. Access to these files is reviewed at the end of each check.

10.4 Change safety

Changes to identity systems can lock out many people at once: a faulty single sign-on setting can stop every user reaching an application. Safe practice is to plan each change, have it reviewed, schedule it for a low-impact time, keep a tested rollback and verify afterwards that sign-in still works for representative users. Sana also ensures that at least one emergency administrator account remains usable during changes, so a mistake cannot remove the ability to fix it. Every change and its outcome is recorded for later review.

Worked example

Sana's authorisation letter lists permitted activities (reading owner-provided exports, test environment work) and excluded ones (production sign-in, password testing, bypass attempts).

Synthetic case. The authorisation and data are synthetic.

Errors and limits

Making identity changes without an emergency administrator path can turn a small mistake into a long outage.

Exercises

EX028 — Uncomfortable duty. What uncomfortable report does Sana's duty require? Rubric: 3 = telling a director former staff still have access;; 2 = raise concern;; 1 = stay silent;; 0 = none.
EX029 — Excluded activities. Name two activities outside Sana's authorisation. Rubric: 3 = production sign-in, password testing, bypass attempts (two);; 2 = one;; 1 = vague;; 0 = none.
EX030 — Emergency account. Why keep an emergency administrator account during changes? Rubric: 3 = so a mistake cannot remove the ability to fix it;; 2 = recovery;; 1 = convenience;; 0 = none.

Synthesis

Professional duty, written authorisation, data care and safe change practice are the foundations of trustworthy identity engineering.

Continue studying — chapter 10 of 50

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →