Chapter 3 — Listing accounts and who uses them
Lesson map
Lesson 03 published. Map, example, EX027.
flowchart TD
N0["Learning outcomes"]
N1["3.1 Why list accounts"]
N2["3.2 Finding accounts"]
N3["3.3 Owners and users"]
N4["3.4 The account check"]
N5["Lab — Account check"]
N6["3.5 Reading the results"]
N7["3.6 Ranking the gaps"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX027"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 Why list accounts"]
N2["3.2 Finding accounts"]
N3["3.3 Owners and users"]
N4["3.4 The account check"]
N5["Lab — Account check"]
N6["3.5 Reading the results"]
N7["3.6 Ranking the gaps"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX027"]
[Learning outcomes]
|
v
[3.1 Why list accounts]
|
v
[3.2 Finding accounts]
|
v
[3.3 Owners and users]
|
v
[3.4 The account check]
|
v
[Lab — Account check]
|
v
[3.5 Reading the results]
|
v
[3.6 Ranking the gaps]
|
v
[Worked example] --> [Exercise EX027]
Learning outcomes
You will (1) list every account; (2) record users, owners and second steps; (3) find the riskiest gaps.
3.1 Why list accounts
You cannot protect accounts you have forgotten. Mia sits with Rosa and lists every online account the shop uses: email, the online shop, card payments, social media, the supplier portal and the accounting package. For each she records the account name, who uses it, who owns it and whether a second sign-in step is turned on. She does not record passwords. The list becomes the shop's map of where access lives, and she saves it in the password manager's notes.
3.2 Finding accounts
Some accounts are easy to forget. Mia looks through the shop's email for welcome messages and invoices from online services, checks the browser's saved sites on the shop computer with Rosa present, and asks staff which websites they use for work. She finds a supplier portal nobody had mentioned. Searching in several places catches accounts that were set up years ago by former staff and never written down anywhere. She adds each new find to the list with Rosa's confirmation, and she notes where she found it so the search can be repeated.
3.3 Owners and users
Every account needs an owner, the person responsible for deciding who may use it, and a list of users. At the florist, Rosa owns every account, but several are used by all staff. Mia notes where the users are more than needed: the online shop admin is used by Rosa and Mia, but the others only need to view orders, which the shop software can allow with a separate staff role. Fewer people with admin rights means fewer ways for mistakes or misuse to happen.
3.4 The account check
Mia writes a short Python script, using only the standard library, that reads the synthetic account list and reports accounts without a second step and accounts that are shared. It only reads the list and prints results, so nothing in the shop's accounts is touched. Joseph checks her script with her and confirms the output matches the list by hand. She tests it first on a tiny list where she already knows the answers. The output is saved with the date, so the check can be repeated in three months and the results compared. Rosa sees the output before any change is planned.
Lab — Account check
"""Account list check for a small shop (synthetic, read-only)."""
# service, account, used by, MFA on?, shared?
ACCOUNTS = [
("email", "owner@shop", "Rosa", True, False),
("email", "orders@shop", "all staff", False, True),
("online shop", "admin", "Rosa, Mia", False, True),
("card payments", "rosa.m", "Rosa", True, False),
("social media", "shop-page", "all staff", False, True),
("supplier portal", "willowlane", "Rosa", False, False),
("accounting", "rosa.m", "Rosa", True, False),
]
def main():
no_mfa = [a for a in ACCOUNTS if not a[3]]
shared = [a for a in ACCOUNTS if a[4]]
print(f"accounts {len(ACCOUNTS)}, MFA on {len(ACCOUNTS) - len(no_mfa)}")
for s, acct, _, _, sh in no_mfa:
print(f"no MFA: {s} ({acct}){' - shared' if sh else ''}")
print(f"shared accounts: {len(shared)}")
if __name__ == "__main__":
main()
Run with python3 lab_accounts.py. Verified output:
accounts 7, MFA on 3
no MFA: email (orders@shop) - shared
no MFA: online shop (admin) - shared
no MFA: social media (shop-page) - shared
no MFA: supplier portal (willowlane)
shared accounts: 3
3.5 Reading the results
The script reads seven accounts. Three have a second step turned on: Rosa's email, card payments and accounting. Four do not: the shared orders mailbox, the shared online shop admin, the shared social media page and the supplier portal. Three accounts are shared. Mia notices that every shared account also lacks a second step, which makes them the riskiest: a password known by many people, with nothing else needed to sign in. Mia confirms these results by hand against the list before sharing them.
3.6 Ranking the gaps
Mia ranks the gaps with her three questions. The orders mailbox comes first, because it receives password resets for the online shop. The online shop admin is second, because it controls prices and payments. Social media is third, because a takeover would harm the shop's reputation. The supplier portal is fourth. She agrees the order with Rosa, who asks her to complete the first three in week four, with the supplier portal following if time allows. She records the order in her notes.
Worked example
The account check shows 7 accounts, 3 with a second step and 3 shared; the four gaps are ranked orders mailbox, shop admin, social media and supplier portal.
Synthetic case. Accounts, the script and results are synthetic.
Errors and limits
Listing only the accounts people remember misses forgotten services set up by former staff.
Exercises
- EX027 — Not recorded. What does Mia not record in the list? Rubric: 3 = passwords;; 2 = secrets;; 1 = owners;; 0 = none.
- EX028 — Forgotten account. Which forgotten account did Mia find? Rubric: 3 = a supplier portal;; 2 = supplier;; 1 = email;; 0 = none.
- EX029 — Search places. Name one place Mia looked for accounts. Rubric: 3 = welcome emails and invoices;; 2 = browser saved sites;; 1 = bins;; 0 = none.
- EX030 — Owner role. What does an account owner do? Rubric: 3 = decides who may use it;; 2 = decides;; 1 = pays;; 0 = none.
- EX031 — Staff view role. What do most staff need in the online shop? Rubric: 3 = only to view orders;; 2 = view;; 1 = admin;; 0 = none.
- EX032 — Second-step count. How many accounts had a second step on? Rubric: 3 = three of seven;; 2 = 3;; 1 = seven;; 0 = none.
- EX033 — Shared count. How many accounts were shared? Rubric: 3 = three;; 2 = 3 shared;; 1 = one;; 0 = none.
- EX034 — Riskiest pattern. Why are the shared accounts riskiest? Rubric: 3 = known by many and no second step;; 2 = both;; 1 = old;; 0 = none.
- EX035 — First gap. Which gap comes first? Rubric: 3 = orders mailbox;; 2 = mailbox;; 1 = supplier;; 0 = none.
- EX036 — Social media rank. Why is social media third? Rubric: 3 = takeover harms reputation;; 2 = reputation;; 1 = cost;; 0 = none.
- EX037 — Script safety. Why is the account script safe to run? Rubric: 3 = it only reads the list and prints;; 2 = read-only;; 1 = it is short;; 0 = none.
- EX038 — Rosa's request. What did Rosa ask for week four? Rubric: 3 = complete the first three gaps;; 2 = three;; 1 = all;; 0 = none.
Synthesis
A complete account list with owners, users and second-step status shows exactly where to act first.
Continue studying — chapter 03 of 04
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →