A named account is not a storage row | Rapid course Cloud and container security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 12. Map, example, EX058.

flowchart TD
  P["Eight staff"] --> A["Named accounts replace the reception login"]
  I["Eight storage triples"] --> F["No person field"]
  A --> Q{"Are the two eights the same set?"}
  F --> Q
  Q -->|No| K["Keep both counts, labelled"]

People and objects share a number and not a table.

Logical drawing

staff:          8 people, reception login replaced
sharing rows:   8 triples, no account column
leaver bits:    1, 1, 1 across May June July
leaver names:   none

Learning outcomes

After this chapter, you should be able to:

Keep the staff count out of the sharing filter.
Say what a named account changes in a log.
Refuse a role hierarchy and a named leaver.

12.1 The reception login was a logging problem, not a triple.

While several people signed in as reception, an activity line could not say which person changed a folder. Named accounts make a later line attributable to one person. That change is prose. The sharing script still has no account field, so the eight triples are not the eight staff. The colleague who shared the letter in January stays unnamed; the export does not identify them.

Sandhu, Coyne, Feinstein, and Youman (1996) separate users, roles, permissions, and sessions. None of those four sets is in the file. The strings staff, admins, and public are setting tokens. The program does not encode admins as a subset of staff, and it does not grant a permission through inheritance. Passing the membership test is not a role assignment.

The routine's leaver cell is 1 in May, June, and July. The bit says the task was marked done. It does not list a leaver, a last day, or a link that was moved to a current member. Account removal is not the deletion of old-backup.zip.

12.2 Worked example

Lesson table; scroll horizontally to read all columns →

Claim	Relation to the files	Decision
Named accounts let a log name one person	Prose about the reception login	May stay
The sharing list has eight rows	`len(items)`	May stay, as objects
"The eight rows are the eight staff."	No person field	Reject
"June's leaver bit names who left."	The bit is only 1	Reject

Synthetic case. No leaver is given a name or a date.

Errors and limits

Do not build a role hierarchy on top of three strings the filter only compares.

Apply

EX058 — Two eights. A classmate treats the eight triples as the eight staff, says admins inherits staff, and reads a leaver's name from the June bit. What do you keep?
Show marking criteria
Rubric: 3 = the eights are different sets; the strings are not a hierarchy; the leaver bits stay 1, 1, 1 with no name; the January colleague stays unnamed;; 2 = reject the merge and the name;; 1 = one correction;; 0 = none.