Chapter 8 — Identity and access management: difficult cases
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Service accounts"]
N2["8.2 Third-party administrators"]
N3["8.3 Legacy systems"]
N4["8.4 Residual risk"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Service accounts"]
N2["8.2 Third-party administrators"]
N3["8.3 Legacy systems"]
N4["8.4 Residual risk"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 Service accounts]
|
v
[8.2 Third-party administrators]
|
v
[8.3 Legacy systems]
|
v
[8.4 Residual risk]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) handle service accounts, third-party administrators and legacy systems; (2) manage exceptions; (3) accept residual risk explicitly.
8.1 Service accounts
Six of Corran's fourteen privileged identities are service accounts used by software, such as backup jobs and the warehouse management interface. They cannot use security keys or just-in-time elevation in the same way as people. Marta documents each with owner, purpose and permissions, reduces permissions to what the task needs, moves credentials into the vault with automatic rotation where the software supports it, and sets alerts for interactive sign-ins, which a service account should never perform. Two accounts turn out to be unused and are disabled after owner confirmation.
8.2 Third-party administrators
The warehouse system supplier administers its software remotely. Previously it used a shared account with permanent access. Marta designs named accounts for each supplier engineer, linked to a Corran sponsor, with access enabled only when a support ticket is open and automatically removed afterwards. Supplier engineers authenticate with strong methods agreed in the contract. Activity is logged and reviewed. This brings third parties into the same principles as staff: named, limited in time and accountable. The contract is updated to require these terms at renewal.
8.3 Legacy systems
One warehouse control system cannot integrate with the cloud directory and has a single local administrator account. Replacement is planned in eighteen months. Meanwhile, the account password is held in the vault, released only through a logged request, and rotated after each use. Physical access to the console is limited. Marta records this as an exception with its compensating controls, its owner and its end date, rather than pretending the system meets the new design. The exception is reviewed every quarter until replacement.
8.4 Residual risk
After the design and exceptions, some risk remains: the legacy system, the supplier's own security practices and the possibility of an administrator's key and device both being stolen. Marta states each residual risk, its likely impact, the compensating controls and who accepts it. Corran's finance director, as risk owner, signs the list. Reviewing it every six months, or after any incident, ensures that accepted risks remain conscious decisions rather than forgotten gaps. Each entry also records the date of the next review and any trigger that would bring it forward.
Worked example
Six service accounts are documented and reduced, two disabled; supplier access becomes ticket-linked named accounts; the legacy controller is a time-limited exception with vault rotation.
Synthetic case. Accounts, suppliers and systems are synthetic.
Errors and limits
Pretending a legacy system meets the new design, instead of recording an exception, hides a known gap.
Exercises
- EX036 — Service account alert. Which activity should alert for a service account? Rubric: 3 = interactive sign-in;; 2 = interactive;; 1 = any;; 0 = none.
- EX037 — Unused service accounts. How many service accounts were found unused? Rubric: 3 = two;; 2 = 2;; 1 = vague;; 0 = none.
- EX038 — Supplier access window. When is supplier engineer access enabled? Rubric: 3 = only while a support ticket is open;; 2 = ticket;; 1 = always;; 0 = none.
- EX039 — Legacy controls. What compensating controls protect the legacy controller? Rubric: 3 = vault, logged release, rotation after use, physical limits;; 2 = vault;; 1 = vague;; 0 = none.
- EX040 — Risk owner. Who signs the residual risk list? Rubric: 3 = finance director as risk owner;; 2 = director;; 1 = Marta;; 0 = none.
Synthesis
Service accounts, suppliers and legacy systems need tailored controls, explicit exceptions and signed residual risk.
Continue studying — chapter 08 of 12
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →