Chapter 19 — Identity and cryptography
Lesson map
Lesson 19 published. Map, example, EX055.
flowchart TD
N0["Learning outcomes"]
N1["19.1 Identity lifecycle"]
N2["19.2 Multi-factor authentication"]
N3["19.3 Cryptographic basics"]
N4["19.4 Key management"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX055"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 Identity lifecycle"]
N2["19.2 Multi-factor authentication"]
N3["19.3 Cryptographic basics"]
N4["19.4 Key management"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX055"]
[Learning outcomes]
|
v
[19.1 Identity lifecycle]
|
v
[19.2 Multi-factor authentication]
|
v
[19.3 Cryptographic basics]
|
v
[19.4 Key management]
|
v
[Worked example] --> [Exercise EX055]
Learning outcomes
You will (1) manage identities through their lifecycle; (2) apply multi-factor authentication; (3) use cryptography appropriately.
19.1 Identity lifecycle
Every account follows a lifecycle: creation when someone joins, changes when they move roles and removal when they leave. Lindiwe finds that Saltmarsh's leavers are removed from the directory but not from the depot routing system, which has its own accounts. She recommends linking all systems to a single identity source so that leaving triggers removal everywhere. Prof. Hale notes that orphaned accounts are a common route for misuse, because nobody notices them being used. The identity team agrees to connect the routing system next quarter.
19.2 Multi-factor authentication
Passwords alone are weak because they can be guessed, reused or phished. Multi-factor authentication requires a second factor, such as a code from an app or a hardware key. Lindiwe compares options for Saltmarsh. Hardware keys resist phishing best; app prompts are easier to deploy but can be approved by tired users who accept unexpected requests. She recommends hardware keys for administrators and app codes for other staff, with phishing-resistant methods expanded later. The security lead approves the plan, starting with the twenty administrators.
19.3 Cryptographic basics
Lindiwe studies symmetric encryption, where one key encrypts and decrypts, and public-key cryptography, where a public key encrypts or verifies and a private key decrypts or signs. Hash functions produce fixed-length fingerprints of data. She learns that the security of each depends on keeping keys secret and using well-reviewed algorithms and libraries. Prof. Hale warns that designing new cryptographic schemes is a specialist field and that engineers should use established ones. She practises with Python's hashlib module, computing fingerprints for synthetic files.
19.4 Key management
Most cryptographic failures come from key handling, not algorithms. Lindiwe reviews how Saltmarsh manages certificates for its websites. Two certificates expired last year, causing outages, because renewal relied on someone remembering. She recommends an inventory of certificates and keys with owners and expiry dates, plus automated renewal where possible. She learns that key management is an operational discipline as much as a technical one. The inventory lists forty certificates in the synthetic export. Six expire within ninety days, and the operations team renews them at once while automation is set up.
Worked example
Lindiwe links leaver removal to a single identity source, chooses hardware keys for administrators, reviews cryptographic building blocks and proposes a certificate inventory with automated renewal.
Synthetic case. Systems are synthetic.
Errors and limits
App-based approval prompts can be accepted by users who did not start a login.
Exercises
- EX055 — Orphaned accounts. Where were leavers not removed? Rubric: 3 = the depot routing system;; 2 = partly correct;; 1 = other;; 0 = none.
- EX056 — Admin factor. Which factor does she recommend for administrators? Rubric: 3 = hardware keys;; 2 = partly correct;; 1 = other;; 0 = none.
- EX057 — Certificate outages. Why did certificates expire? Rubric: 3 = renewal relied on memory;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 19 (chapter 19 of 50)
← Chapter 18 · Course chapter index · Chapter 20 →
Continue to the next authored lesson.