Identity and access: foundations and first decisions

Learning outcomes

You will (1) explain what identity and access control protect; (2) describe a small shop's accounts; (3) choose first steps with limited time.

1.1 Why this course

Mia Clarke works part-time at the fictional Willow Lane Florist, a single shop with six staff run by its owner, Rosa. Mia joins a one-month rapid course at the fictional Eastgate Skills Centre to learn the basics of identity and access, coached by Joseph Mensah. Rosa has asked her to help make the shop's online accounts safer. Everything in this book, including the shop, staff and accounts, is synthetic, and every change Mia makes is agreed with Rosa first. She keeps a short diary of each week.

1.2 What access control protects

Identity and access control decide who can sign in to each account and what they can do once inside. At the florist, accounts protect customer orders and addresses, card payment records, the online shop, supplier orders, the accounts package and the shop's social media page. If someone else got into the online shop admin, they could change prices or redirect payments. If they got into email, they could reset passwords for every other account. Access control protects money, customers and reputation.

1.3 Three simple ideas

Joseph teaches three ideas. Identification is saying who you are, such as a username. Authentication is proving it, with a password and ideally a second step. Authorisation is what you may do once signed in. Mia sees that a shared login breaks identification, because nobody knows who made a change; a weak password breaks authentication; and giving everyone admin rights breaks authorisation. Knowing which idea a problem belongs to helps her pick the right fix. She writes the three ideas on a card to use all month.

1.4 Why email comes first

Email matters most, because most services send password reset links there. Whoever controls the shop's email can take over the online shop, social media and supplier accounts. Joseph explains that protecting email with a strong password and a second step is usually the single most valuable action for a small business. Mia notes that the shop has two email accounts: Rosa's own and a shared orders mailbox that all staff use. She marks both mailboxes at the top of her priority list, and she notes that the shared one is used by all six staff.

1.5 Choosing first steps

Mia has four weeks and little budget, so she learns to rank steps by three questions: how much harm does it prevent, what does it cost, and could it disrupt the shop? Turning on a second sign-in step for email prevents much harm, is free and causes little disruption, so it comes first. Buying new software would come later, if at all. Ranking keeps a short course focused on actions that remove the most risk quickly. Rosa agrees the ranking before work starts.

1.6 Guidance worth knowing

Good guidance exists even for small shops. NIST SP 800-63B, a US government guide to digital identity, recommends long passwords checked against lists of known-leaked ones and favours stronger second steps such as passkeys. Passkeys use the W3C WebAuthn standard and only work on the genuine website, which protects against fake sign-in pages. Mia does not need to read whole standards; Joseph summarises the key points so her advice rests on recognised sources rather than guesswork. Joseph gives her the source names so she can cite them.

1.7 The plan for the month

Joseph and Mia agree a plan with Rosa. In week one, understand the accounts and choose priorities. In week two, agree what Mia may do and learn safe habits. In week three, list every account, who uses it and whether it has a second step. In week four, make the agreed changes, check them against a checklist and write a short report. A clear plan helps Rosa know what to expect and when. Rosa agrees the dates and adds them to the shop calendar.

Worked example

Mia's notes list seven accounts and two email mailboxes; her first priority is a second sign-in step on email, because it controls password resets.

Synthetic case. Willow Lane Florist, Mia Clarke, Rosa, Joseph Mensah, Eastgate Skills Centre and all data are synthetic; NIST SP 800-63B and W3C WebAuthn are real sources.

Errors and limits

Spending the first week comparing paid products delays free steps that remove most risk.

Exercises

• EX001 — Shop size. How many staff does the florist have?
  Show marking criteria

  Rubric: 3 = six, one shop;; 2 = six;; 1 = sixty;; 0 = none.
• EX002 — Admin takeover harm. What could someone do in the online shop admin?
  Show marking criteria

  Rubric: 3 = change prices or redirect payments;; 2 = payments;; 1 = vague;; 0 = none.
• EX003 — Authentication meaning. What is authentication?
  Show marking criteria

  Rubric: 3 = proving who you are;; 2 = proof;; 1 = username;; 0 = none.
• EX004 — Authorisation meaning. What is authorisation?
  Show marking criteria

  Rubric: 3 = what you may do once signed in;; 2 = permissions;; 1 = password;; 0 = none.
• EX005 — Shared login problem. Which idea does a shared login break?
  Show marking criteria

  Rubric: 3 = identification;; 2 = who did it;; 1 = speed;; 0 = none.
• EX006 — Email importance. Why protect email first?
  Show marking criteria

  Rubric: 3 = password resets go there;; 2 = resets;; 1 = it is free;; 0 = none.
• EX007 — Mailboxes. Which two email accounts does the shop have?
  Show marking criteria

  Rubric: 3 = Rosa's own and shared orders mailbox;; 2 = two;; 1 = one;; 0 = none.
• EX008 — Ranking questions. What three questions rank each step?
  Show marking criteria

  Rubric: 3 = harm prevented, cost, disruption;; 2 = three;; 1 = one;; 0 = none.
• EX009 — Top step. Why does a second step on email come first?
  Show marking criteria

  Rubric: 3 = high harm prevented, free, little disruption;; 2 = cheap;; 1 = required;; 0 = none.
• EX010 — Password guidance. What does NIST SP 800-63B recommend for passwords?
  Show marking criteria

  Rubric: 3 = long and checked against leaked lists;; 2 = long;; 1 = symbols;; 0 = none.
• EX011 — Passkey benefit. Why do passkeys resist fake sign-in pages?
  Show marking criteria

  Rubric: 3 = only work on the genuine site;; 2 = genuine site;; 1 = longer;; 0 = none.
• EX012 — Week three. What happens in week three?
  Show marking criteria

  Rubric: 3 = list accounts, users and second steps;; 2 = listing;; 1 = report;; 0 = none.
• EX013 — Plan benefit. How does the plan help Rosa?
  Show marking criteria

  Rubric: 3 = she knows what to expect and when;; 2 = clarity;; 1 = vague;; 0 = none.

Synthesis

Knowing what accounts protect and taking high-value, low-cost steps first is the basis of practical access control.

Continue studying — lesson 01 (chapter 01 of 20)

← Course home · Course chapter index · Chapter 02 →