Chapter 1 — Identity and access: foundations and first decisions
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Why this course"]
N2["1.2 What access control protects"]
N3["1.3 Three simple ideas"]
N4["1.4 Why email comes first"]
N5["1.5 Choosing first steps"]
N6["1.6 Guidance worth knowing"]
N7["1.7 The plan for the month"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Why this course"]
N2["1.2 What access control protects"]
N3["1.3 Three simple ideas"]
N4["1.4 Why email comes first"]
N5["1.5 Choosing first steps"]
N6["1.6 Guidance worth knowing"]
N7["1.7 The plan for the month"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Why this course]
|
v
[1.2 What access control protects]
|
v
[1.3 Three simple ideas]
|
v
[1.4 Why email comes first]
|
v
[1.5 Choosing first steps]
|
v
[1.6 Guidance worth knowing]
|
v
[1.7 The plan for the month]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain what identity and access control protect; (2) describe a small shop's accounts; (3) choose first steps with limited time.
1.1 Why this course
Mia Clarke works part-time at the fictional Willow Lane Florist, a single shop with six staff run by its owner, Rosa. Mia joins a one-month rapid course at the fictional Eastgate Skills Centre to learn the basics of identity and access, coached by Joseph Mensah. Rosa has asked her to help make the shop's online accounts safer. Everything in this book, including the shop, staff and accounts, is synthetic, and every change Mia makes is agreed with Rosa first. She keeps a short diary of each week.
1.2 What access control protects
Identity and access control decide who can sign in to each account and what they can do once inside. At the florist, accounts protect customer orders and addresses, card payment records, the online shop, supplier orders, the accounts package and the shop's social media page. If someone else got into the online shop admin, they could change prices or redirect payments. If they got into email, they could reset passwords for every other account. Access control protects money, customers and reputation.
1.3 Three simple ideas
Joseph teaches three ideas. Identification is saying who you are, such as a username. Authentication is proving it, with a password and ideally a second step. Authorisation is what you may do once signed in. Mia sees that a shared login breaks identification, because nobody knows who made a change; a weak password breaks authentication; and giving everyone admin rights breaks authorisation. Knowing which idea a problem belongs to helps her pick the right fix. She writes the three ideas on a card to use all month.
1.4 Why email comes first
Email matters most, because most services send password reset links there. Whoever controls the shop's email can take over the online shop, social media and supplier accounts. Joseph explains that protecting email with a strong password and a second step is usually the single most valuable action for a small business. Mia notes that the shop has two email accounts: Rosa's own and a shared orders mailbox that all staff use. She marks both mailboxes at the top of her priority list, and she notes that the shared one is used by all six staff.
1.5 Choosing first steps
Mia has four weeks and little budget, so she learns to rank steps by three questions: how much harm does it prevent, what does it cost, and could it disrupt the shop? Turning on a second sign-in step for email prevents much harm, is free and causes little disruption, so it comes first. Buying new software would come later, if at all. Ranking keeps a short course focused on actions that remove the most risk quickly. Rosa agrees the ranking before work starts.
1.6 Guidance worth knowing
Good guidance exists even for small shops. NIST SP 800-63B, a US government guide to digital identity, recommends long passwords checked against lists of known-leaked ones and favours stronger second steps such as passkeys. Passkeys use the W3C WebAuthn standard and only work on the genuine website, which protects against fake sign-in pages. Mia does not need to read whole standards; Joseph summarises the key points so her advice rests on recognised sources rather than guesswork. Joseph gives her the source names so she can cite them.
1.7 The plan for the month
Joseph and Mia agree a plan with Rosa. In week one, understand the accounts and choose priorities. In week two, agree what Mia may do and learn safe habits. In week three, list every account, who uses it and whether it has a second step. In week four, make the agreed changes, check them against a checklist and write a short report. A clear plan helps Rosa know what to expect and when. Rosa agrees the dates and adds them to the shop calendar.
Worked example
Mia's notes list seven accounts and two email mailboxes; her first priority is a second sign-in step on email, because it controls password resets.
Synthetic case. Willow Lane Florist, Mia Clarke, Rosa, Joseph Mensah, Eastgate Skills Centre and all data are synthetic; NIST SP 800-63B and W3C WebAuthn are real sources.
Errors and limits
Spending the first week comparing paid products delays free steps that remove most risk.
Exercises
- EX001 — Shop size. How many staff does the florist have? Rubric: 3 = six, one shop;; 2 = six;; 1 = sixty;; 0 = none.
- EX002 — Admin takeover harm. What could someone do in the online shop admin? Rubric: 3 = change prices or redirect payments;; 2 = payments;; 1 = vague;; 0 = none.
- EX003 — Authentication meaning. What is authentication? Rubric: 3 = proving who you are;; 2 = proof;; 1 = username;; 0 = none.
- EX004 — Authorisation meaning. What is authorisation? Rubric: 3 = what you may do once signed in;; 2 = permissions;; 1 = password;; 0 = none.
- EX005 — Shared login problem. Which idea does a shared login break? Rubric: 3 = identification;; 2 = who did it;; 1 = speed;; 0 = none.
- EX006 — Email importance. Why protect email first? Rubric: 3 = password resets go there;; 2 = resets;; 1 = it is free;; 0 = none.
- EX007 — Mailboxes. Which two email accounts does the shop have? Rubric: 3 = Rosa's own and shared orders mailbox;; 2 = two;; 1 = one;; 0 = none.
- EX008 — Ranking questions. What three questions rank each step? Rubric: 3 = harm prevented, cost, disruption;; 2 = three;; 1 = one;; 0 = none.
- EX009 — Top step. Why does a second step on email come first? Rubric: 3 = high harm prevented, free, little disruption;; 2 = cheap;; 1 = required;; 0 = none.
- EX010 — Password guidance. What does NIST SP 800-63B recommend for passwords? Rubric: 3 = long and checked against leaked lists;; 2 = long;; 1 = symbols;; 0 = none.
- EX011 — Passkey benefit. Why do passkeys resist fake sign-in pages? Rubric: 3 = only work on the genuine site;; 2 = genuine site;; 1 = longer;; 0 = none.
- EX012 — Week three. What happens in week three? Rubric: 3 = list accounts, users and second steps;; 2 = listing;; 1 = report;; 0 = none.
- EX013 — Plan benefit. How does the plan help Rosa? Rubric: 3 = she knows what to expect and when;; 2 = clarity;; 1 = vague;; 0 = none.
Synthesis
Knowing what accounts protect and taking high-value, low-cost steps first is the basis of practical access control.