Chapter 3 — Identity and access management: specialist evidence
Lesson map
Lesson 03 published. Map, example, EX011.
flowchart TD
N0["Learning outcomes"]
N1["3.1 Measuring standing privilege"]
N2["Lab — Standing versus just-in-time"]
N3["3.2 Reading the result"]
N4["3.3 Interpreting carefully"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX011"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 Measuring standing privilege"]
N2["Lab — Standing versus just-in-time"]
N3["3.2 Reading the result"]
N4["3.3 Interpreting carefully"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX011"]
[Learning outcomes]
|
v
[3.1 Measuring standing privilege]
|
v
[Lab — Standing versus just-in-time]
|
v
[3.2 Reading the result]
|
v
[3.3 Interpreting carefully]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX011]
Learning outcomes
You will (1) measure standing privilege; (2) gather evidence on how administrators actually work; (3) interpret specialist data carefully.
3.1 Measuring standing privilege
Standing privilege means rights held all the time, whether or not they are being used. Marta measures it as privilege-hours: the number of administrators multiplied by hours in a week during which they hold full rights. With eight permanent administrators, that is 1,344 privilege-hours every week. She then asks how many hours administrators actually need full rights, using change records and interviews. The difference between held and needed privilege is exposure that serves no purpose, and it becomes a central measure in her project.
Lab — Standing versus just-in-time
"""Standing versus just-in-time administrator privilege-hours per week for synthetic admins (stdlib only)."""
admins = {"adm01": 3.0, "adm02": 6.5, "adm03": 1.0, "adm04": 0.5, "adm05": 4.0, "adm06": 2.0, "adm07": 0.0, "adm08": 1.5}
standing = len(admins) * 168
jit = sum(admins.values())
print(f"admins={len(admins)} standing_priv_hours={standing} jit_priv_hours={jit:.1f} reduction={100*(1-jit/standing):.1f}%")
print("never activated:", [a for a, h in admins.items() if h == 0])
Run with python3 lab_standing.py. Verified output:
admins=8 standing_priv_hours=1344 jit_priv_hours=18.5 reduction=98.6%
never activated: ['adm07']
3.2 Reading the result
In the synthetic data, the eight administrators actually needed full rights for 18.5 hours in a typical week. Under just-in-time elevation, privilege-hours would fall from 1,344 to 18.5, a reduction of about 98.6 percent. One administrator, adm07, needed full rights not at all, which raises the question of whether that account is needed. Marta treats the figure carefully: it assumes elevation would match need exactly, and emergencies may add hours. Still, the scale of the difference shows how much exposure permanent rights create.
The 1,344 figure is simply eight administrators holding full rights for all 168 hours of the week.
3.3 Interpreting carefully
Specialist data can mislead. Change records may miss urgent fixes made without tickets, so needed hours may be underestimated. Interviews may reflect what administrators think they do rather than what they do. Marta compares change records, interviews and directory logs, and where they disagree she investigates. For example, logs show adm02 using administrator rights late on several evenings, which change records do not explain; it turns out to be a scheduled report that could run under a service account with much narrower rights.
Worked example
Standing privilege of 1,344 hours per week compares with 18.5 hours needed; adm07 never needs full rights and adm02's evening use is moved to a narrow service account.
Synthetic case. Administrators, hours and logs are synthetic.
Errors and limits
Assuming change records capture every administrator action underestimates the real need for elevation.
Exercises
- EX011 — Standing hours. What standing privilege-hours does the lab compute? Rubric: 3 = 1,344 per week;; 2 = 1344;; 1 = 18.5;; 0 = none.
- EX012 — JIT reduction. What reduction would just-in-time give in the lab? Rubric: 3 = about 98.6%, to 18.5 hours;; 2 = 98.6%;; 1 = 50%;; 0 = none.
- EX013 — Unused admin. Which administrator never needed full rights? Rubric: 3 = adm07;; 2 = one;; 1 = adm02;; 0 = none.
- EX014 — Triangulation sources. Which three sources does Marta compare? Rubric: 3 = change records, interviews, directory logs;; 2 = two;; 1 = one;; 0 = none.
- EX015 — Evening use fix. How is adm02's evening administrator use addressed? Rubric: 3 = scheduled report moved to narrow service account;; 2 = service account;; 1 = ignored;; 0 = none.
Synthesis
Measuring standing versus needed privilege reveals exposure that serves no purpose, and careful triangulation keeps the measure honest.
Continue studying — chapter 03 of 12
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →