Chapter 23 — Identity and access management: threat and failure analysis
Lesson map
Lesson 23 published. Map, example, EX067.
flowchart TD
N0["Learning outcomes"]
N1["23.1 Threat analysis"]
N2["23.2 Failure analysis"]
N3["Lab — Ranking threats and failures"]
N4["23.3 Prioritisation"]
N5["23.4 Residual risk"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX067"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 Threat analysis"]
N2["23.2 Failure analysis"]
N3["Lab — Ranking threats and failures"]
N4["23.3 Prioritisation"]
N5["23.4 Residual risk"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX067"]
[Learning outcomes]
|
v
[23.1 Threat analysis]
|
v
[23.2 Failure analysis]
|
v
[Lab — Ranking threats and failures]
|
v
[23.3 Prioritisation]
|
v
[23.4 Residual risk]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX067]
Learning outcomes
You will (1) analyse identity threats and failures; (2) rank them by likelihood and impact; (3) state residual risk.
23.1 Threat analysis
Sana analyses threats to each part of the design: staff credentials, the service desk, the identity provider, its signing keys, integrations and administrator accounts. For each she asks who might attack it, how, and what they would gain, drawing on the threat categories from chapter 15 and on interviews with council staff about past incidents. She records each threat with its likely source, the affected components and evidence for its likelihood, such as audit findings or published guidance, rather than relying only on intuition about what seems dangerous.
23.2 Failure analysis
Failures matter as much as attacks. Sana asks what happens when parts break: the identity provider is unreachable, the HR feed stops, a signing certificate expires, or a connector to an application fails silently. For each she records the effect, how it would be detected and the planned response. A provider outage blocks all integrated applications, so she plans emergency access for critical services. A silent connector failure is especially dangerous because leavers would keep access with no alarm raised.
Lab — Ranking threats and failures
"""Rank synthetic identity threats and failures by likelihood x impact (stdlib only)."""
items = [("Phished password reused at provider", 4, 5), ("Leaver keeps app access", 5, 3), ("Desk reset by impersonation", 3, 4),
("Signing certificate expires", 2, 5), ("Over-broad group grant", 4, 3), ("Provider outage at peak", 2, 4),
("Stale service account abused", 2, 4), ("Admin console reachable without MFA", 3, 5)]
for name, l, i in sorted(items, key=lambda x: -x[1]*x[2]):
print(f"{l*i:2} L={l} I={i} {name}")
Run with python3 lab_risk.py. Verified output:
20 L=4 I=5 Phished password reused at provider
15 L=5 I=3 Leaver keeps app access
15 L=3 I=5 Admin console reachable without MFA
12 L=3 I=4 Desk reset by impersonation
12 L=4 I=3 Over-broad group grant
10 L=2 I=5 Signing certificate expires
8 L=2 I=4 Provider outage at peak
8 L=2 I=4 Stale service account abused
23.3 Prioritisation
The synthetic ranking puts a phished password reused at the provider highest at 20, followed by a leaver keeping access and an administrator console reachable without multi-factor at 15. Desk impersonation and over-broad group grants score 12. Certificate expiry scores 10 because its impact is high even though it is unlikely. Sana uses the ranking to order work, but she treats scores as rough: a five-point scale hides uncertainty, and items with the same score may differ greatly. She records the evidence behind each score and revisits the ranking after each incident.
23.4 Residual risk
After controls are designed, some risk remains. Phishing-resistant authentication reduces credential theft but does not remove it for staff on legacy applications that cannot use the provider. Prompt leaver removal shrinks the window but does not close it for accounts in systems the connectors do not reach. Sana states each residual risk, why it is acceptable for now and who accepted it. The council's senior information risk owner signs the list, which is reviewed when circumstances change, such as a new application or an incident.
Worked example
The ranking orders eight synthetic items from 20 down to 8; Sana's work plan tackles provider authentication, leaver removal and administrator protection first, with residual risks signed by the risk owner.
Synthetic case. Scores, items and owners are synthetic.
Errors and limits
Treating risk scores as precise measurements hides the uncertainty behind a simple scale.
Exercises
- EX067 — Top risk. Which item ranks highest in the lab, with what score? Rubric: 3 = phished password reused at provider, 20;; 2 = phishing;; 1 = certificate;; 0 = none.
- EX068 — Certificate score reason. Why does certificate expiry score 10 despite being unlikely? Rubric: 3 = impact is very high;; 2 = impact 5;; 1 = likely;; 0 = none.
- EX069 — Silent connector danger. Why is a silent connector failure especially dangerous? Rubric: 3 = leavers keep access with no alarm;; 2 = no alarm;; 1 = speed;; 0 = none.
Synthesis
Analysing threats and failures together, ranking with evidence and stating residual risk gives the design honest priorities.
Continue studying — chapter 23 of 50
← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →