Chapter 15 — Security fundamentals | Engineering Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 15 — Security fundamentals

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 CIA for identity"]
  N2["15.2 Least privilege and separation of duties"]
  N3["15.3 Defence in depth"]
  N4["15.4 Identity threat categories"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 CIA for identity"]
  N2["15.2 Least privilege and separation of duties"]
  N3["15.3 Defence in depth"]
  N4["15.4 Identity threat categories"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX043"]

[Learning outcomes]
    |
    v
[15.1 CIA for identity]
    |
    v
[15.2 Least privilege and separation of duties]
    |
    v
[15.3 Defence in depth]
    |
    v
[15.4 Identity threat categories]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) apply confidentiality, integrity and availability to identity; (2) use least privilege and separation of duties; (3) categorise identity threats.

15.1 CIA for identity

Confidentiality in identity means credentials, tokens and personal data are not exposed. Integrity means accounts, group memberships and policies change only through authorised processes. Availability means staff can sign in when they need to. The three can conflict: very strict sign-in rules protect confidentiality but may hurt availability if staff are locked out. Sana states which property each control supports and how it might harm another, so trade-offs are made consciously rather than discovered after rollout. Each conflict is recorded with the choice made and who accepted it.

15.2 Least privilege and separation of duties

Least privilege means each person and system has only the access needed for their role. Separation of duties means no single person can complete a sensitive task alone, such as raising and approving the same payment. Saltzer and Schroeder (1975) described related principles decades ago, and NIST SP 800-53 Rev. 5 includes both in its access control family. At Linmouth, Sana treats them as design requirements: roles are built from job functions, and conflicting permissions are prevented from being held together.

A role combining payment raising and approval, for example, is rejected at design time rather than discovered in a later review.

15.3 Defence in depth

No single identity control is enough. Strong authentication, least privilege, monitoring of sign-ins, regular access reviews and rapid leaver processing each address different failures. If an attacker obtains a session, least privilege limits what they can reach; if a review is skipped, the leaver process may still remove access; if monitoring misses an event, the review may catch the result later. Sana checks that layers fail independently, since two controls relying on the same data feed can fail together. Independence is checked during design review.

15.4 Identity threat categories

Sana groups identity threats to check her design systematically: credential theft through phishing or reuse; abuse of recovery and reset processes; excessive or stale privileges; misuse by authorised insiders; compromise of the identity provider or its signing keys; and failures of integration such as misconfigured redirects. For each category she lists the controls that reduce it and the evidence that they work. The categories prompt thinking but are not complete, so she also asks council staff about threats specific to their services.

Worked example

Sana's threat table lists six identity threat categories, each linked to at least two controls and one verification method.

Synthetic case. Threat entries and controls are synthetic.

Errors and limits

Making sign-in so strict that staff are routinely locked out trades confidentiality for availability without saying so.

Exercises

EX043 — CIA conflict. How can strict sign-in harm availability? Rubric: 3 = lockouts stop staff working;; 2 = lockout;; 1 = it cannot;; 0 = none.
EX044 — Separation example. Give an example of separation of duties. Rubric: 3 = raising and approving the same payment kept apart;; 2 = payments;; 1 = passwords;; 0 = none.
EX045 — Recovery threat. Which threat category covers abuse of reset processes? Rubric: 3 = recovery and reset abuse;; 2 = recovery;; 1 = insider;; 0 = none.

Synthesis

CIA, least privilege, separation of duties, defence in depth and threat categories give identity design its security foundations.

Continue studying — chapter 15 of 50

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →