◇ OpenCyber Academy
Master's · Chapter 4 · English

Chapter 4 — Identity and access management: competing explanations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Identity and access management: competing explanations

Lesson map

Lesson 04 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Why alternatives matter"]
  N2["Lab — Normalised reset rate"]
  N3["4.2 Reading the normalised series"]
  N4["4.3 Testing other explanations"]
  N5["4.4 Where risk moved"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Why alternatives matter"]
  N2["Lab — Normalised reset rate"]
  N3["4.2 Reading the normalised series"]
  N4["4.3 Testing other explanations"]
  N5["4.4 Where risk moved"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX021"]

[Learning outcomes]
    |
    v
[4.1 Why alternatives matter]
    |
    v
[Lab — Normalised reset rate]
    |
    v
[4.2 Reading the normalised series]
    |
    v
[4.3 Testing other explanations]
    |
    v
[4.4 Where risk moved]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) identify alternative explanations for a fall in resets; (2) normalise for headcount; (3) test each explanation against evidence.

4.1 Why alternatives matter

A fall in password resets after passkey enrolment could have other causes. Headcount changes alter raw counts. A new self-service reset portal launched at the same time would cut desk tickets regardless of passkeys. Holidays reduce sign-ins and therefore resets. Desk staff might categorise tickets differently after training. And the password expiry policy, if changed, would remove a common trigger for resets. Jonah lists every plausible alternative, then checks each against evidence, because a dissertation that claims a cause without ruling out rivals will not convince examiners or Halyard's managers.

Lab — Normalised reset rate

"""Normalise synthetic weekly password-reset tickets per 100 active staff, before and after passkey enrolment (stdlib only)."""
import statistics as st
before = [(41, 880), (38, 884), (44, 890), (40, 893), (39, 895), (43, 899)]
after = [(27, 930), (24, 936), (22, 941), (23, 946), (21, 950), (20, 955)]
rb = [100*t/s for t, s in before]; ra = [100*t/s for t, s in after]
print("before per100:", [f"{r:.2f}" for r in rb]); print("after  per100:", [f"{r:.2f}" for r in ra])
print(f"raw mean {st.mean(t for t,_ in before):.1f} -> {st.mean(t for t,_ in after):.1f}; rate mean {st.mean(rb):.2f} -> {st.mean(ra):.2f}; change {100*(st.mean(ra)/st.mean(rb)-1):.0f}%")

Run with python3 lab_rate.py. Verified output:

before per100: ['4.66', '4.30', '4.94', '4.48', '4.36', '4.78']
after  per100: ['2.90', '2.56', '2.34', '2.43', '2.21', '2.09']
raw mean 40.8 -> 22.8; rate mean 4.59 -> 2.42; change -47%

4.2 Reading the normalised series

In the synthetic data, raw weekly resets fall from a mean of 40.8 to 22.8. But headcount also rose, from about 880 to 955 staff, so Jonah normalises: the rate per hundred staff falls from 4.59 to 2.42, a reduction of about 47 percent. Normalisation actually strengthens the finding here, since more staff would be expected to generate more resets. The weekly values are also stable within each period, with no single unusual week driving the change, which reduces the chance that one holiday or outage explains the result.

4.3 Testing other explanations

Jonah checks the alternatives one by one. Halyard's change calendar shows no self-service portal launch during the study. Password expiry policy was unchanged, having been removed years earlier in line with current NIST guidance. Ticket categories were checked by hand on a sample from each period and applied consistently. Holidays fell in both periods. Finally, not-yet-enrolled departments show only a small fall over the same weeks. With each rival explanation examined and found weak, passkey enrolment becomes the most plausible explanation, though Jonah still describes it as an association supported by a comparison design, not a proof.

4.4 Where risk moved

Jonah also checks whether work simply moved elsewhere. Recovery requests for lost or replaced devices rose from almost none to about three a week. Each takes longer than a password reset, because it needs a video identity check. He reports this honestly: the desk handles fewer requests in total, but each recovery is more involved. From a security view the shift is positive, since the recovery path is harder to abuse than a phone reset, but Halyard should plan desk capacity for recovery and encourage staff to register a second passkey to reduce lost-device cases.

Worked example

Normalised reset rate falls 47 percent while headcount rises; rival explanations such as a portal launch, policy change and recategorisation are checked and found weak; recovery requests rise modestly.

Synthetic case. Rates, headcount and calendar entries are synthetic.

Errors and limits

Reporting raw counts when headcount changes can exaggerate or hide real effects.

Exercises

Synthesis

Normalising and testing rival explanations one by one turns a raw drop in tickets into a credible, bounded claim.

Continue studying — chapter 04 of 08

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →