OpenCyber Academy
Professional · Chapter 4 · English
Course code: OCA-025Chapter 04: OCA-025-C004

Chapter 4 — Accounts and multi-factor sign-in

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Why it matters"]
  N2["4.2 Account types"]
  N3["Lab — Multi-factor sign-in coverage by account type"]
  N4["4.3 Reading the results"]
  N5["4.4 Closing the gaps"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Why it matters"]
  N2["4.2 Account types"]
  N3["Lab — Multi-factor sign-in coverage by account type"]
  N4["4.3 Reading the results"]
  N5["4.4 Closing the gaps"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 Why it matters]
    |
    v
[4.2 Account types]
    |
    v
[Lab — Multi-factor sign-in coverage by account type]
    |
    v
[4.3 Reading the results]
    |
    v
[4.4 Closing the gaps]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) explain why multi-factor sign-in matters; (2) measure coverage by account type; (3) plan fixes for gaps.

4.1 Why it matters

Daniel's top risk is mailbox takeover after phishing. Ms. Ashby explains that a stolen password alone is enough to take over an account protected only by a password, but a second factor, such as an app prompt or a security key, stops most such attempts. She notes that attackers increasingly try to trick users into approving prompts, so the method matters too. Daniel decides to measure how many Corbridge accounts already use a second factor before proposing anything, because a recommendation based on numbers is easier for partners to accept.

4.2 Account types

Daniel exports a list of accounts from the email and identity service, with permission from Mrs. Pike, and groups them into four types: partners, staff, administrators and service accounts. Service accounts are used by software rather than people, such as the scanner that emails documents into folders. He replaces names with codes before using the list in coursework. Ms. Ashby points out that administrators deserve separate attention because one compromised administrator account can change settings for everyone, so their coverage matters more than the overall total.

Lab — Multi-factor sign-in coverage by account type in a synthetic directory

"""Measure multi-factor sign-in coverage by account type in a synthetic directory (stdlib only)."""
import random
from collections import Counter
random.seed(25)
accounts = []
for kind, n, p in [("partner", 8, 0.75), ("staff", 52, 0.6), ("admin", 4, 0.5), ("service", 6, 0.0)]:
    for i in range(n):
        accounts.append((kind, random.random() < p))
total = Counter(k for k, _ in accounts)
on = Counter(k for k, m in accounts if m)
for k in total:
    print(f"{k}: {on[k]} of {total[k]} with MFA ({on[k]/total[k]:.1%})")
print(f"all accounts: {sum(on.values())} of {len(accounts)} ({sum(on.values())/len(accounts):.1%})")

Run with python3 lab_mfa.py. Verified output:

partner: 4 of 8 with MFA (50.0%)
staff: 39 of 52 with MFA (75.0%)
admin: 1 of 4 with MFA (25.0%)
service: 0 of 6 with MFA (0.0%)
all accounts: 44 of 70 (62.9%)

4.3 Reading the results

The script finds 44 of 70 synthetic accounts using a second factor, 62.9 percent overall. Staff are highest at 39 of 52, or 75 percent. Partners are at 4 of 8, or 50 percent. Administrators are lowest among people, at 1 of 4, or 25 percent. None of the six service accounts use a second factor. Daniel sees that the overall figure hides the most important gaps: the accounts with most power and the partners who approve payments are the least protected, which matches the invoice fraud risk. He shares the table with the support company before the partners see it.

4.4 Closing the gaps

Daniel proposes enabling a second factor for all administrators within a week and all partners within a month, with the support company present to help. For service accounts, which often cannot use a second factor, he asks the support company to restrict where each can sign in from and to remove any that are no longer needed. Ms. Ashby advises him to explain the change to partners in terms of the invoice fraud risk they already worry about, rather than as a technical rule. Mrs. Pike agrees to go first, to set an example.

Worked example

Daniel measures synthetic coverage: 44 of 70 accounts (62.9 percent), administrators 1 of 4, partners 4 of 8, service accounts 0 of 6, and plans fixes starting with administrators.

Synthetic case. Accounts are synthetic and anonymised.

Errors and limits

An overall coverage figure can hide gaps in the most powerful accounts.

Exercises

Worked answers

EX016. 44 of 70 accounts, 62.9 percent.

EX017. One of four administrators, 25 percent.

EX018. Restrict where each can sign in from and remove unused ones.

EX019. In terms of the invoice fraud risk they already worry about.

EX020. Mrs. Pike, the managing partner.