Chapter 33 — Identity and access management: safety and resilience | Engineering Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 33 — Identity and access management: safety and resilience

Lesson map

Lesson 33 published. Map, example, EX097.

flowchart TD
  N0["Learning outcomes"]
  N1["33.1 Critical services"]
  N2["33.2 Degraded modes"]
  N3["33.3 Recovery"]
  N4["33.4 Exercises"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX097"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["33.1 Critical services"]
  N2["33.2 Degraded modes"]
  N3["33.3 Recovery"]
  N4["33.4 Exercises"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX097"]

[Learning outcomes]
    |
    v
[33.1 Critical services]
    |
    v
[33.2 Degraded modes]
    |
    v
[33.3 Recovery]
    |
    v
[33.4 Exercises]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX097]

Learning outcomes

You will (1) identify services where sign-in failure endangers people; (2) design degraded modes; (3) plan recovery and exercises.

33.1 Critical services

Some council services affect people's safety: emergency planning, social care case records used during out-of-hours calls and housing repairs for vulnerable tenants. If staff cannot sign in to these, harm could follow. Sana lists critical services with their owners, acceptable outage times and dependencies on identity. Each owner agrees what must happen if sign-in fails. This list guides design choices, such as which applications keep cached access or offline procedures, and the order of recovery after a disruption. The list is reviewed with owners every year.

33.2 Degraded modes

A degraded mode is a planned way to continue with reduced function. For out-of-hours social care, staff carry a printed contact list and use a phone line to a duty manager who can access records through an emergency account. For emergency planning, a small set of pre-authorised laptops keep cached credentials valid for a limited time. Degraded modes are written down, rehearsed and still controlled: emergency use is logged and reviewed afterwards, so safety arrangements do not quietly become a permanent way around normal controls.

33.3 Recovery

Recovery restores normal sign-in after a disruption. The plan lists steps in order: confirm the cause, restore provider configuration from version control if needed, verify that critical services work first, then the rest, and finally check that monitoring and lifecycle connectors have resumed. Each step has an owner and expected time. Recovery is not complete until leavers processed during the outage have been checked, because a connector backlog could leave people with access they should have lost. Timings are compared with targets after each exercise or real event.

33.4 Exercises

Plans are tested through exercises. In a tabletop exercise, the identity team, service desk and two critical service owners walk through a scenario: the provider is unreachable at 08:00 on a Monday. Each participant describes their actions. The exercise reveals that the duty manager's emergency key is stored in a building that is locked at weekends, and that the desk script lacks wording for this case. Findings are recorded, plans updated and the exercise repeated in six months. Exercises are run without blame, so people report gaps honestly.

Worked example

A tabletop exercise on a Monday-morning provider outage reveals an inaccessible emergency key and a missing desk script; both are fixed and the exercise is scheduled again in six months.

Synthetic case. Services, scenario and findings are synthetic.

Errors and limits

Degraded modes that are not logged and reviewed can become a permanent route around normal controls.

Exercises

EX097 — Critical example. Name one council service where sign-in failure could endanger people. Rubric: 3 = emergency planning, out-of-hours social care or vulnerable tenant repairs;; 2 = one;; 1 = payroll;; 0 = none.
EX098 — Recovery completion. What must be checked before recovery is complete? Rubric: 3 = leavers processed during the outage;; 2 = leaver backlog;; 1 = vague;; 0 = none.
EX099 — Exercise finding. What did the tabletop exercise reveal about the emergency key? Rubric: 3 = stored in a building locked at weekends;; 2 = inaccessible;; 1 = lost;; 0 = none.

Synthesis

Knowing critical services, planning controlled degraded modes, ordered recovery and regular exercises keep people safe when sign-in fails.

Continue studying — chapter 33 of 50

← Chapter 32 (draft) · Course chapter index · Chapter 34 (draft) →