Chapter 6 — Calculus II | Engineering Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 06 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Totals from rates"]
  N2["6.2 Growth models"]
  N3["6.3 Retention estimates"]
  N4["6.4 Checking with data"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Totals from rates"]
  N2["6.2 Growth models"]
  N3["6.3 Retention estimates"]
  N4["6.4 Checking with data"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX016"]

[Learning outcomes]
    |
    v
[6.1 Totals from rates]
    |
    v
[6.2 Growth models]
    |
    v
[6.3 Retention estimates]
    |
    v
[6.4 Checking with data]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) compute totals from rates; (2) model growth of accounts and logs; (3) estimate storage for audit records.

6.1 Totals from rates

If the identity provider records audit events at a known rate, the total stored over a period is the integral of that rate. When the rate varies through the day, the area under the curve gives the daily total. Sana uses this to estimate log storage: if events average 30 per second during working hours and 3 per second at night, she integrates the piecewise rate to find about 1.1 million events per day, assuming nine working hours. Multiplying by average record size gives storage needed before any compression.

6.2 Growth models

Some quantities grow in proportion to their size. If the number of cloud applications connected to the identity provider grows by five percent a month, the growth is exponential and doubles in about fourteen months. A straight-line forecast would underestimate future load. Other quantities decay: the share of staff still using old one-time-code methods may halve every few months during a passkey rollout. Choosing the right model, and checking it against measurements, prevents both overspending on capacity and running out unexpectedly.

6.3 Retention estimates

Audit records must be kept long enough to support investigations, which often start weeks after events. Sana multiplies daily volume by the retention period required by council policy, adds headroom for growth and for incident periods, when logging often increases, and estimates compressed storage. The required period comes from policy and legal duties, not from what fits on an existing disk. She documents each assumption so the estimate can be updated when real volumes are measured after rollout. Retention for each record type is reviewed annually.

6.4 Checking with data

Models are only useful if they match reality. During a pilot, Sana compares predicted log volume with measured volume. If measured volume is double the estimate, she traces which assumption was wrong, such as events per sign-in or record size, and corrects it. Recording each assumption separately makes this tracing straightforward. The corrected model then becomes the basis for the full design, which is far safer than discovering a shortfall when the storage fills during an investigation. The pilot thus validates both the model and the method.

Worked example

Integrating a piecewise event rate gives about 1.1 million audit events per day; at 500 bytes each, a year's retention needs roughly 210 gigabytes before compression.

Synthetic case. Rates, sizes and policies are synthetic.

Errors and limits

Linear forecasts of exponential growth underestimate future identity provider load.

Exercises

EX016 — Area meaning. What does the area under an event-rate curve represent?
Show marking criteria
Rubric: 3 = total events over the period;; 2 = total;; 1 = peak;; 0 = none.
EX017 — Doubling time. At five percent monthly growth, roughly when does load double?
Show marking criteria
Rubric: 3 = about fourteen months;; 2 = about a year;; 1 = five months;; 0 = none.
EX018 — Retention source. Where should the required retention period come from?
Show marking criteria
Rubric: 3 = policy and legal duties, not disk size;; 2 = policy;; 1 = disk;; 0 = none.

Synthesis

Integrals turn rates into totals, and checked growth models keep capacity and retention plans realistic.

Continue studying — chapter 06 of 50

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →