◇ OpenCyber Academy
Engineering · Chapter 20 · English

Chapter 20 — Identity and access management: engineering context

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 20 — Identity and access management: engineering context

Lesson map

Lesson 20 published. Map, example, EX058.

flowchart TD
  N0["Learning outcomes"]
  N1["20.1 Current state"]
  N2["20.2 Constraints"]
  N3["20.3 The engineering problem"]
  N4["20.4 Success measures"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX058"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["20.1 Current state"]
  N2["20.2 Constraints"]
  N3["20.3 The engineering problem"]
  N4["20.4 Success measures"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX058"]

[Learning outcomes]
    |
    v
[20.1 Current state]
    |
    v
[20.2 Constraints]
    |
    v
[20.3 The engineering problem]
    |
    v
[20.4 Success measures]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX058]

Learning outcomes

You will (1) describe Linmouth's current identity state; (2) record constraints; (3) state the engineering problem and success measures.

20.1 Current state

Linmouth has an on-premises directory for laptop sign-in and email, plus about 140 applications. Around 60 use their own local accounts; 50 sync accounts from the directory; and 30 cloud services each have their own sign-up. HR sends a monthly leaver list by email to IT, who forward it to application owners. Multi-factor authentication covers email only. Sana records this state with dated evidence, including counts of accounts per system, so later improvements can be measured against a fair baseline rather than impressions.

The 60 applications with local accounts are where leavers are most likely to keep access, since the monthly email relies on each owner acting.

20.2 Constraints

Constraints shape what is possible: a limited budget, a small identity team of three, some legacy applications that cannot use modern federation, union agreements on monitoring of staff, and the need to keep council services running throughout. Some applications are supplied by vendors who must make changes themselves. Sana writes these down early and agrees them with the council, because a design that ignores constraints may look excellent and still fail when the team cannot operate it or the budget runs out halfway.

20.3 The engineering problem

Stated plainly, the problem is to give every member of staff one strong sign-in for all council applications they need, to grant access by role with exceptions governed, to remove access promptly when people move or leave, and to produce evidence that these things happen, all within the constraints and without disrupting services. A clear statement keeps later work focused. Sana tests each design option and each piece of work against it, asking whether it moves the council closer to that outcome.

20.4 Success measures

Sana agrees measures with the council before work starts: the share of applications integrated with single sign-on; the share of staff using phishing-resistant authentication; median time from HR leaver date to access removal; the number of accounts with no matching employee; and service desk password tickets per hundred staff. Each has a baseline, a target and a collection method. Agreeing them in advance prevents results being reinterpreted later to look better than they are. Results are reported to directors every quarter against these targets.

Worked example

Baseline: 0 of 140 applications on single sign-on, multi-factor only for email, median leaver removal 19 days, 312 accounts with no matching employee across sampled systems.

Synthetic case. Counts and timings are synthetic.

Errors and limits

Starting design without a measured baseline makes it impossible to show improvement credibly.

Exercises

Synthesis

A documented baseline, written constraints, a clear problem statement and agreed measures frame the whole engineering effort.

Continue studying — chapter 20 of 50

← Chapter 19 (draft) · Course chapter index · Chapter 21 (draft) →