◇ OpenCyber Academy
Rapid course · Chapter 2 · English

Chapter 2 — Week 2: Accounts and safer settings

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Week 2: Accounts and safer settings

Lesson map

Lesson 02 published. Map, example, EX014.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Standard accounts"]
  N2["2.2 Getting software without admin"]
  N3["2.3 Passwords and MFA"]
  N4["2.4 Key settings"]
  N5["2.5 Front desk PC"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX014"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Standard accounts"]
  N2["2.2 Getting software without admin"]
  N3["2.3 Passwords and MFA"]
  N4["2.4 Key settings"]
  N5["2.5 Front desk PC"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX014"]

[Learning outcomes]
    |
    v
[2.1 Standard accounts]
    |
    v
[2.2 Getting software without admin]
    |
    v
[2.3 Passwords and MFA]
    |
    v
[2.4 Key settings]
    |
    v
[2.5 Front desk PC]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX014]

Learning outcomes

You will (1) move everyone to standard accounts; (2) secure email sign-in with MFA; (3) apply a few key settings.

2.1 Standard accounts

Four laptops have users working as administrators. That means any harmful program they open can change anything on the laptop. Leah creates a separate admin account on each laptop, known only to her and the deputy manager and kept in the password manager, and changes the everyday accounts to standard users. Saltzer and Schroeder called this least privilege: give each user only the rights they need.

The four were FB02, FB04, FB07 and FB09. For the volunteers, little changes day to day: they open the same apps and save to the same places. What changes is that a harmful attachment opened in a standard account cannot install itself system-wide or turn off Defender, so it does far less damage. Leah made the change in two evenings and checked each laptop afterwards by signing in as the everyday user.

2.2 Getting software without admin

Volunteers sometimes need a new app. Instead of giving them admin rights, Leah installs approved apps herself, usually within a day. She keeps a short list of approved apps so requests are quick.

The approved list grows from real requests: a volunteer who needs a PDF editor for donation receipts asks once, Leah checks the app's publisher and source, installs it, and adds it to the list so the next request takes minutes. The monthly routine checks that nobody has become an administrator again, which is the usual way this arrangement erodes.

2.3 Passwords and MFA

The cloud email service holds client names and addresses. Leah turns on multi-factor authentication for every account, with an authenticator app on volunteers' phones and backup codes kept in the office safe. She asks everyone to use a long passphrase and a password manager. Shared logins, such as the front desk account, get their own strong password stored in a shared vault.

This matters even with encrypted laptops: a stolen password could open the cloud email from anywhere, and encryption does nothing about that. In the worked example, two volunteers needed help setting up the authenticator app, which Leah gave in person on their next shift. Keeping backup codes in the office safe means a volunteer who loses a phone can still sign in after Leah checks who they are.

2.4 Key settings

Leah applies a handful of settings from the CIS Benchmark that matter most: Windows firewall on, screen lock after five minutes of inactivity, guest account off, and Microsoft Defender with tamper protection on. She does this by hand on each laptop with a printed checklist, because twelve laptops do not justify a management system yet.

Each setting has a reason in this case. The firewall blocks unexpected connections when laptops are used on other networks. The five-minute lock protects laptops left open between clients. The guest account is off so nobody can sign in without an account. Tamper protection stops a harmful program from switching off Defender. The printed checklist also records which laptops have been done, so the next one picks up where the last stopped.

2.5 Front desk PC

The shared front desk PC is used by many volunteers. It gets a standard account that opens only the browser and the booking system, and the screen locks when unattended. Volunteers sign in to the booking system with their own accounts so actions are traceable.

The front desk PC is the device most likely to be used by someone Leah has never met, which is why it is the most limited. Because it opens only the browser and the booking system, a volunteer cannot install software or browse to unrelated sites by habit. Personal booking accounts mean a wrong entry can be traced to the person and corrected with them, not blamed on "front desk".

Worked example

In two evenings Leah changes the four admin users to standard, turns on MFA for all fourteen email accounts, and applies the four key settings with her checklist. Two volunteers need help setting up the authenticator app, which she gives in person on their next shift.

Synthetic case. Figures are synthetic.

Errors and limits

Turning on MFA without backup codes can lock someone out if they lose their phone.

Exercises

Synthesis

By the end of week two, nobody works as an administrator, email is protected by MFA and every laptop has the key settings.

Continue studying — chapter 02 of 04

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →