Chapter 4 — Making changes, checking them and reporting
Lesson map
Lesson 04 published. Map, example, EX039.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Turning on second steps"]
N2["4.2 Fixing shared logins"]
N3["4.3 Removing former staff"]
N4["4.4 The checklist"]
N5["Lab — Checklist score"]
N6["4.5 Reading the score"]
N7["4.6 The short report"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX039"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Turning on second steps"]
N2["4.2 Fixing shared logins"]
N3["4.3 Removing former staff"]
N4["4.4 The checklist"]
N5["Lab — Checklist score"]
N6["4.5 Reading the score"]
N7["4.6 The short report"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX039"]
[Learning outcomes]
|
v
[4.1 Turning on second steps]
|
v
[4.2 Fixing shared logins]
|
v
[4.3 Removing former staff]
|
v
[4.4 The checklist]
|
v
[Lab — Checklist score]
|
v
[4.5 Reading the score]
|
v
[4.6 The short report]
|
v
[Worked example] --> [Exercise EX039]
Learning outcomes
You will (1) make agreed access changes; (2) check them against a checklist; (3) write a short report for the owner.
4.1 Turning on second steps
In week four Mia helps make the agreed changes, with Rosa signing in herself. For the orders mailbox, the email service allows separate staff accounts with access to a shared mailbox, so each staff member gets their own sign-in with an authenticator app, and the old shared password is retired. For Rosa's admin accounts, Rosa sets up a passkey on her phone. Mia checks each sign-in works before moving on, so nobody is locked out during a busy day. Each change is noted.
4.2 Fixing shared logins
For the online shop, Mia and Rosa create a staff role that can view and pack orders but not change prices or payment settings, and give each staff member their own login. Only Rosa and Mia keep admin rights, both with a second step. The social media service allows people to be added as page helpers using their own accounts, so the shared login is removed. The note by the till is shredded once the old passwords no longer work.
4.3 Removing former staff
Mia asks Rosa who has left in the past two years. Two former staff are still listed as helpers on the social media page, and one still has a login to the online shop. Rosa removes them. Mia explains that when shared passwords were in use, former staff might also have remembered them, which is why changing shared passwords and moving to personal logins matters. She adds leaving to the staff habits list. She records each removal and the date.
4.4 The checklist
Mia writes a standard-library script that compares a before-and-after checklist of eight items, such as every account listed with an owner, a second step on key accounts, no written shared passwords, a password manager in use, former staff removed and recovery details up to date. The script reads only the synthetic checklist and prints the scores, so it changes nothing. Mia fills in the before list during week one and the after list at the end of week four, with Rosa confirming each item. She tests the script on a small known example first, and saves both outputs with the report.
Lab — Checklist score
"""Before/after access checklist score for a small shop (synthetic, read-only)."""
ITEMS = [
"every account listed with an owner",
"MFA on email",
"MFA on online shop admin",
"MFA on social media",
"no shared passwords written down",
"password manager in use",
"former staff removed",
"recovery details up to date",
]
BEFORE = {0, 1}
AFTER = {0, 1, 2, 3, 4, 5, 6}
def main():
for name, done in (("before", BEFORE), ("after", AFTER)):
print(f"{name}: {len(done)}/{len(ITEMS)}")
for i, item in enumerate(ITEMS):
if i not in AFTER:
print("still to do:", item)
if __name__ == "__main__":
main()
Run with python3 lab_checklist.py. Verified output:
before: 2/8
after: 7/8
still to do: recovery details up to date
4.5 Reading the score
Before the course, the shop met 2 of 8 items; afterwards it meets 7 of 8. The one remaining item is keeping recovery details up to date: some accounts still list a former staff member's phone number for account recovery. Mia explains that recovery details are how an account is regained if a password or phone is lost, so wrong details could let someone else reset an account or lock Rosa out. Rosa agrees to update them the following week.
Moving from 2 to 7 of 8 within the course shows how far a small shop can get with short, concrete steps.
4.6 The short report
Mia writes Rosa a one-page report in plain words: what was found, what was changed, the checklist score from 2 to 7 of 8, what remains and three habits to keep: add and remove people promptly, keep a second step on every account, and check the account list every three months. She adds the supplier portal as the next account to secure. Joseph reviews the report, and Rosa keeps it with the account list in the password manager. Rosa signs it.
Keeping it beside the account list means whoever next checks the list also sees what was agreed.
Worked example
Personal logins replace three shared accounts, three former staff lose access and the checklist rises from 2 to 7 of 8; recovery details remain.
Synthetic case. Changes, scores and people are synthetic.
Errors and limits
Turning on second steps for everyone in the middle of a busy day without checking each sign-in risks locking staff out.
Exercises
- EX039 — Rosa's method. What second step does Rosa use for admin accounts? Rubric: 3 = a passkey on her phone;; 2 = passkey;; 1 = text;; 0 = none.
- EX040 — Mailbox fix. How was the shared orders mailbox fixed? Rubric: 3 = personal sign-ins with access to the shared mailbox;; 2 = personal;; 1 = new password;; 0 = none.
- EX041 — Staff role. What can the shop staff role do? Rubric: 3 = view and pack orders, not change prices;; 2 = view;; 1 = everything;; 0 = none.
- EX042 — Till note fate. What happened to the till password note? Rubric: 3 = shredded after old passwords stopped working;; 2 = shredded;; 1 = kept;; 0 = none.
- EX043 — Former staff found. How many former staff still had access? Rubric: 3 = three;; 2 = 3;; 1 = vague;; 0 = none.
- EX044 — Score change. How did the checklist score change? Rubric: 3 = 2 to 7 of 8;; 2 = improved;; 1 = fell;; 0 = none.
- EX045 — Remaining item. Which item remains? Rubric: 3 = recovery details up to date;; 2 = recovery;; 1 = MFA;; 0 = none.
- EX046 — Recovery risk. Why do wrong recovery details matter? Rubric: 3 = could let someone else reset or lock Rosa out;; 2 = reset;; 1 = vague;; 0 = none.
- EX047 — Report habits. Name one habit in the report. Rubric: 3 = check the account list every three months;; 2 = add/remove promptly;; 1 = vague;; 0 = none.
- EX048 — Next account. Which account is next to secure? Rubric: 3 = supplier portal;; 2 = supplier;; 1 = email;; 0 = none.
- EX049 — Report storage. Where does Rosa keep the report? Rubric: 3 = in the password manager with the account list;; 2 = manager;; 1 = desk;; 0 = none.
- EX050 — Checking sign-in. Why check each sign-in before moving on? Rubric: 3 = so nobody is locked out on a busy day;; 2 = lockout;; 1 = speed;; 0 = none.
Synthesis
Agreed changes, a simple checklist and a short report leave a small business safer and able to keep going alone.
Continue studying — chapter 04 of 04
← Chapter 03 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →