Chapter 19 — Identity and cryptography

Lesson map

Lesson 19 published. Map, example, EX055.

flowchart TD
  N0["Learning outcomes"]
  N1["19.1 Identity life cycle"]
  N2["19.2 Cryptography and policy"]
  N3["19.3 Keys as assets"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX055"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["19.1 Identity life cycle"]
  N2["19.2 Cryptography and policy"]
  N3["19.3 Keys as assets"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX055"]

[Learning outcomes]
    |
    v
[19.1 Identity life cycle]
    |
    v
[19.2 Cryptography and policy]
    |
    v
[19.3 Keys as assets]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX055]

Learning outcomes

You will (1) govern identities across their life cycle; (2) relate cryptographic controls to policy; (3) manage keys as governed assets.

19.1 Identity life cycle

Identities at Ardwell are created when staff join, change when they move and must end when they leave. Nadia maps this joiner, mover and leaver process and finds that movers are the weak point: new access is granted quickly but old access is rarely removed. She proposes that the human resources system trigger access changes automatically and that managers confirm access for movers within two weeks. Governance of identity is mainly governance of these transitions, where most excess access begins. Movers who keep old billing access, for instance, can accumulate rights that no single role would ever grant.

19.2 Cryptography and policy

Nadia studies how encryption protects data at rest and in transit, and how digital signatures protect integrity. She links them to policy: Ardwell's data classification requires encryption for customer payment data and personal data on laptops. ISO/IEC 27002:2022 includes a control on the use of cryptography that expects rules for its use and for key management. She learns that cryptography is only as strong as the policy decisions about where to use it and how to manage it. For personal data on laptops, for example, the policy decision is that encryption is mandatory, while the key management rules decide who can recover a locked device.

19.3 Keys as assets

Keys must be generated, stored, rotated and destroyed under control. Nadia lists Ardwell's important keys, including the payment portal's certificates, and finds one certificate managed by a single engineer with no backup or expiry tracking. If it expired unnoticed, the portal would fail. She records owners, expiry dates and backup arrangements for each key in an inventory. She learns that key management failures are usually governance failures, such as missing ownership, rather than weaknesses in the cryptography itself. Adding expiry dates to the inventory would let the portal certificate be renewed before customers see a failure.

Worked example

Nadia fixes the mover gap with automated triggers, links encryption to classification and inventories keys with owners and expiry dates.

Synthetic case. Identities, keys and processes are synthetic; ISO/IEC 27002:2022 is real.

Errors and limits

Automation fails when HR data are wrong. Key inventories go stale.

Exercises

• EX055 — Weak transition. Which identity transition is Ardwell's weak point?
  Show marking criteria

  Rubric: 3 = movers, because old access is rarely removed;; 2 = movers, without explanation;; 1 = leavers;; 0 = none.
• EX056 — Encryption rule. Which data does Ardwell's classification require to be encrypted?
  Show marking criteria

  Rubric: 3 = payment data and personal data on laptops;; 2 = classification;; 1 = vague;; 0 = none.
• EX057 — Certificate risk. Why was the single-engineer certificate a risk?
  Show marking criteria

  Rubric: 3 = no backup or expiry tracking, so it could expire unnoticed;; 2 = ownership;; 1 = vague;; 0 = none.

Synthesis

Identity and cryptographic controls succeed or fail through governance of transitions and keys.

Continue studying — chapter 19 of 50

← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →