Chapter 1 — Foundations of identity and access
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Three questions"]
N3["1.3 The landscape and scope"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Three questions"]
N3["1.3 The landscape and scope"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case]
|
v
[1.2 Three questions]
|
v
[1.3 The landscape and scope]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain identity, authentication and authorisation; (2) describe the firm's identity landscape; (3) agree a supervised scope.
1.1 The case
Daniel Okafor has worked in IT support for six years and is moving into security through a six-month professional course at the fictional Pinewood Professional Academy. His mentor is Helen Brooks, a senior identity engineer. His partner organisation is the fictional Ashby and Lane Accountants, with three offices and about 60 staff who handle client tax records and financial statements. Every account, log and figure in this book is synthetic, and Daniel works only within a written scope agreed with the firm's managing partner.
1.2 Three questions
Identity and access management answers three questions: who is this (identification), can they prove it (authentication), and what may they do (authorisation). Daniel already resets passwords and creates accounts, but the course asks him to see these tasks as controls with risks and evidence. A forgotten leaver account is an authorisation failure; a reused password is an authentication weakness; a shared login breaks identification. Seeing which question a problem belongs to helps him choose the right fix rather than the most familiar one.
1.3 The landscape and scope
Ashby and Lane uses a cloud directory for email and documents, a practice management system for client work, tax filing software, a billing system and a file share with client folders. External auditors and some clients have guest access to shared folders. Daniel's scope, signed by the managing partner, allows him to review settings and exports, propose changes and apply approved ones, but not to open client files. A clear scope protects clients' confidentiality and gives his work a recorded authority.
Worked example
Daniel maps five systems and guest access to shared folders; his signed scope covers settings and exports but not client file contents.
Synthetic case. Daniel Okafor, Helen Brooks, Pinewood Professional Academy, Ashby and Lane Accountants and all data are synthetic.
Errors and limits
Treating identity tasks as routine support jobs rather than controls hides their risk and evidence.
Exercises
- EX001 — Firm profile. Describe Ashby and Lane. Rubric: 3 = three offices, about 60 staff, accountants;; 2 = accountants;; 1 = bakery;; 0 = none.
- EX002 — Forgotten leaver. Which question does a forgotten leaver account fail? Rubric: 3 = authorisation;; 2 = access;; 1 = authentication;; 0 = none.
- EX003 — Shared login. Which question does a shared login break? Rubric: 3 = identification;; 2 = who;; 1 = authorisation;; 0 = none.
- EX004 — Scope exclusion. What does Daniel's scope exclude? Rubric: 3 = opening client files;; 2 = client files;; 1 = settings;; 0 = none.
- EX005 — Guest users. Who has guest access? Rubric: 3 = external auditors and some clients;; 2 = externals;; 1 = nobody;; 0 = none.
Synthesis
Framing work by identification, authentication and authorisation, within a signed scope, is the foundation for identity security.