Chapter 45 — Independent design review | Engineering Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 45 — Independent design review

Lesson map

Lesson 45 published. Map, example, EX133.

flowchart TD
  N0["Learning outcomes"]
  N1["45.1 Why independent review"]
  N2["45.2 Findings"]
  N3["45.3 Responses"]
  N4["45.4 Learning from review"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX133"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["45.1 Why independent review"]
  N2["45.2 Findings"]
  N3["45.3 Responses"]
  N4["45.4 Learning from review"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX133"]

[Learning outcomes]
    |
    v
[45.1 Why independent review]
    |
    v
[45.2 Findings]
    |
    v
[45.3 Responses]
    |
    v
[45.4 Learning from review]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX133]

Learning outcomes

You will (1) obtain an independent review of the capstone design; (2) respond to findings; (3) strengthen the evidence.

45.1 Why independent review

An independent reviewer, not involved in the project, examines the capstone design and evidence. Sana arranges a review by an identity architect from another public body, under a confidentiality agreement and using redacted material. Independent eyes catch assumptions that people close to the work no longer notice. The reviewer is asked to judge whether the design meets its requirements, whether evidence supports the claims, and whether any significant risk has been missed or understated in the residual risk register. Its findings are recorded formally.

45.2 Findings

The reviewer raises four findings. Proxy applications rely on headers that the proxy adds, so the application must reject any request not coming through the proxy; this is not yet tested. Emergency access accounts are excluded from all conditional policies, including logging alerts for one policy. The residual risk for scripted checks understates the window during which a leaver retains access. And the decision log lacks the reason for one token lifetime choice. Each finding comes with evidence and a suggested severity.

45.3 Responses

Sana responds to each finding in a table: the finding, her assessment, the action and the evidence of completion. She adds tests confirming that proxied applications refuse direct requests, corrects the emergency account exclusion so alerts still fire, revises the residual risk statement with a measured window of up to twenty-four hours and adds the missing decision record. Where she disagrees with a severity, she explains why with evidence. The reviewer confirms the responses, and the record goes into the evidence dossier.

45.4 Learning from review

Sana reflects that two findings concerned assumptions she had stopped questioning: that nobody could reach a proxied application directly and that emergency account exclusions were harmless. Independent review is valuable precisely because it targets such blind spots. She recommends that the council arrange independent review for future major identity changes and adds a review step to the change process for high-risk changes, so the benefit continues after her project. She also adds both assumptions to the design checklist, so future engineers test them explicitly rather than relying on memory.

Worked example

Four independent findings lead to direct-access tests for proxied applications, restored alerts for emergency accounts, a corrected residual risk window and a completed decision log.

Synthetic case. Reviewer, findings and responses are synthetic.

Errors and limits

Assuming that a proxied application cannot be reached directly leaves a path around the provider untested.

Exercises

EX133 — Proxy finding. What must a proxied application do according to the review? Rubric: 3 = reject requests not coming through the proxy;; 2 = reject direct;; 1 = vague;; 0 = none.
EX134 — Residual window. What leaver window does the revised residual risk state for scripted checks? Rubric: 3 = up to twenty-four hours;; 2 = 24h;; 1 = vague;; 0 = none.
EX135 — Lasting change. What lasting process change does Sana recommend? Rubric: 3 = independent review step for high-risk identity changes;; 2 = review step;; 1 = vague;; 0 = none.

Synthesis

Independent review targets blind spots, and evidenced responses turn findings into stronger design and evidence.

Continue studying — chapter 45 of 50

← Chapter 44 (draft) · Course chapter index · Chapter 46 (draft) →