Chapter 9 — Identity and access management: leadership and assurance | Postgraduate Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Identity and access management: leadership and assurance

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Reporting to the board"]
  N2["9.2 Assurance"]
  N3["9.3 Answering the insurer"]
  N4["9.4 Leadership lessons"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Reporting to the board"]
  N2["9.2 Assurance"]
  N3["9.3 Answering the insurer"]
  N4["9.4 Leadership lessons"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 Reporting to the board]
    |
    v
[9.2 Assurance]
    |
    v
[9.3 Answering the insurer]
    |
    v
[9.4 Leadership lessons]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) report privileged access status to the board; (2) provide assurance with evidence; (3) answer an insurer's questions.

9.1 Reporting to the board

Marta prepares a one-page board report: the problem, the chosen design, results from the pilot and rollout, remaining risks and next steps. Figures include privilege-hours before and after, the share of administrator accounts with phishing-resistant keys, out-of-window activations reviewed and residual risks accepted. She uses plain language and one chart. Board members ask whether the changes slowed operations; she answers with the pilot's two-minute median elevation time and the single delay, now fixed. Board members receive the full assurance pack on request.

9.2 Assurance

Assurance means giving confidence, based on evidence, that controls work. Marta assembles an assurance pack: configuration exports showing settings, test results from the verification exercises, samples of elevation requests linked to change tickets, activation reviews and the residual risk register. Each item is dated and traceable. Corran's external auditor reviews a sample and confirms the evidence supports the claims, adding a recommendation to test vault emergency release twice a year. Marta adds the recommendation to the sustaining plan, with the security lead named as owner of the tests and their results.

9.3 Answering the insurer

The insurer's questionnaire, which started the project, asks how privileged access is controlled. Corran can now answer precisely: named administrator accounts, phishing-resistant authentication, just-in-time elevation linked to change, vaulted emergency and legacy credentials, monitored activity and documented exceptions. Each answer references evidence. Marta cautions against overclaiming, such as saying all privileged access is just-in-time when service accounts and the legacy system are exceptions, because inaccurate answers to insurers can cause problems if a claim is ever made. The answers are reviewed by the finance director.

9.4 Leadership lessons

Marta reflects on leading change without formal authority. Progress came from explaining risks in business terms, involving administrators early, piloting before committing and reporting honestly. The board supported the work because it saw evidence and understood trade-offs. She also learned that assurance is ongoing: controls drift, people change and new systems arrive, so evidence must be refreshed regularly rather than assembled once and filed away. She notes these lessons in her dissertation as practical guidance for engineers who must lead change from within a team rather than from a management position, which is common in smaller organisations.

Worked example

The board report shows privilege-hours falling by about 98 percent with minimal delay; an auditor confirms the assurance pack; the insurer receives precise, evidenced answers with exceptions stated.

Synthetic case. Reports, auditors and insurers are synthetic.

Errors and limits

Overclaiming to an insurer, such as saying all privileged access is just-in-time, can cause problems if a claim is made.

Exercises

EX041 — Board figures. Name two figures in the board report. Rubric: 3 = privilege-hours, key coverage, off-window reviews, residual risks (two);; 2 = one;; 1 = vague;; 0 = none.
EX042 — Assurance meaning. What is assurance? Rubric: 3 = confidence, based on evidence, that controls work;; 2 = evidence;; 1 = hope;; 0 = none.
EX043 — Auditor recommendation. What did the auditor recommend? Rubric: 3 = test vault emergency release twice a year;; 2 = testing;; 1 = vague;; 0 = none.
EX044 — Overclaim example. What overclaim does Marta warn against? Rubric: 3 = saying all privileged access is just-in-time;; 2 = all JIT;; 1 = vague;; 0 = none.
EX045 — Ongoing assurance. Why must assurance evidence be refreshed? Rubric: 3 = controls drift, people change, new systems arrive;; 2 = drift;; 1 = rules;; 0 = none.

Synthesis

Plain board reporting, evidenced assurance and accurate external answers make privileged access management credible.

Continue studying — chapter 09 of 12

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →