Chapter 2 — Identity and access management: current practice
Lesson map
Lesson 02 published. Map, example, EX006.
flowchart TD
N0["Learning outcomes"]
N1["2.1 What privileged access means"]
N2["2.2 Common practices"]
N3["2.3 Corran against practice"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX006"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 What privileged access means"]
N2["2.2 Common practices"]
N3["2.3 Corran against practice"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX006"]
[Learning outcomes]
|
v
[2.1 What privileged access means]
|
v
[2.2 Common practices]
|
v
[2.3 Corran against practice]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX006]
Learning outcomes
You will (1) describe current practice in privileged access management; (2) relate it to published guidance; (3) assess Corran against it.
2.1 What privileged access means
Privileged accounts can change systems, read any data or create other accounts. They include directory administrators, server administrators, database owners and service accounts with broad rights. Misuse of one, whether by an attacker or by mistake, can affect the whole organisation. Current practice treats privileged access as a distinct problem from ordinary access, with stronger authentication, tighter control over when privilege is held and closer monitoring. Marta begins by listing every privileged identity at Corran, including service accounts, finding fourteen in total rather than the eight that staff first mentioned.
2.2 Common practices
Several practices are now widespread. Administrators use separate administrator accounts, not their everyday accounts. Strong, phishing-resistant authentication, as described in NIST SP 800-63B-4, protects those accounts. Just-in-time elevation grants full rights only when needed, for a limited time, with a recorded reason. Credentials for shared or emergency accounts are kept in a vault and released with logging. Sessions on critical systems may be recorded. And privileged activity is monitored for unusual patterns. Zero trust guidance in NIST SP 800-207 reinforces the idea that standing trust should be minimised.
2.3 Corran against practice
Marta compares Corran with these practices. Administrators use their everyday accounts with administrator rights attached. Multi-factor authentication uses text message codes. Rights are permanent. Two night-shift administrators share an account whose password is on a sticky note in a locked office. No vault exists. Monitoring alerts only on failed sign-ins. She presents this gap analysis factually, noting that Corran's practices are common for its size and history, which helps leaders accept the findings without defensiveness. Each gap is linked to the risk it creates and the practice that would close it.
2.4 Limits of best practice
Published practice describes what many organisations do, not what every organisation must do. Some practices, such as full session recording, need tools and staff time Corran may not have. Marta distinguishes practices that address Corran's main risks cheaply, such as separate administrator accounts and phishing-resistant keys, from those whose value depends on scale. This avoids recommending an expensive suite simply because it appears in vendor material, and focuses Corran's limited budget on the controls that matter most for its situation.
Worked example
Marta's gap analysis finds fourteen privileged identities, everyday accounts used for administration, text-code multi-factor, permanent rights, a shared night-shift account and no vault.
Synthetic case. Identities, practices and findings are synthetic; NIST SP 800-63B-4 and SP 800-207 are real sources.
Errors and limits
Recommending every published practice regardless of scale wastes a small organisation's budget.
Exercises
- EX006 — Privileged count. How many privileged identities did Marta find? Rubric: 3 = fourteen, including service accounts;; 2 = 14;; 1 = 8;; 0 = none.
- EX007 — JIT meaning. What is just-in-time elevation? Rubric: 3 = full rights only when needed, time-limited, with reason;; 2 = temporary rights;; 1 = permanent;; 0 = none.
- EX008 — Night shift account. How is the night-shift account's password kept? Rubric: 3 = on a sticky note in a locked office;; 2 = written;; 1 = vault;; 0 = none.
- EX009 — Gap tone. Why present the gap analysis factually and as common practice? Rubric: 3 = helps leaders accept findings without defensiveness;; 2 = acceptance;; 1 = style;; 0 = none.
- EX010 — Scale-dependent practice. Which practice's value depends on scale? Rubric: 3 = full session recording;; 2 = recording;; 1 = separate accounts;; 0 = none.
Synthesis
Current practice separates, strengthens, limits and monitors privileged access; organisations adopt what fits their risks.
Continue studying — chapter 02 of 12
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →