Chapter 12 — MFA coverage lab
Lesson map
Lesson 12 published. Map, example, EX045.
flowchart TD
N0["Learning outcomes"]
N1["12.1 The report"]
N2["Lab — MFA coverage"]
N3["12.2 Interpreting results"]
N4["12.3 Planning improvements"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX045"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 The report"]
N2["Lab — MFA coverage"]
N3["12.2 Interpreting results"]
N4["12.3 Planning improvements"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX045"]
[Learning outcomes]
|
v
[12.1 The report]
|
v
[Lab — MFA coverage]
|
v
[12.2 Interpreting results]
|
v
[12.3 Planning improvements]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX045]
Learning outcomes
You will (1) run an MFA coverage report on synthetic data; (2) interpret coverage by role; (3) plan improvements.
12.1 The report
Tomas writes a standard-library script that reads synthetic counts of staff, staff with multi-factor authentication and staff with phishing-resistant methods for each role at Millbrook. It prints coverage per role and in total. The script reads only synthetic data and changes nothing. Reporting by role matters because the risk differs: a missing method on an admin account matters more than on a role with little access, so the next steps can be ordered sensibly. He tests the script on known numbers first and keeps each monthly output for comparison.
Lab — MFA coverage
"""MFA coverage by role on synthetic data (read-only)."""
# role: (staff, with MFA, with phishing-resistant method)
ROLES = {
"dentist": (6, 6, 2),
"nurse": (10, 8, 0),
"reception": (8, 5, 0),
"manager": (2, 2, 2),
"admin-it": (2, 2, 2),
}
def pct(a, b):
return round(100 * a / b)
def main():
total = sum(v[0] for v in ROLES.values())
mfa = sum(v[1] for v in ROLES.values())
pr = sum(v[2] for v in ROLES.values())
for role, (n, m, p) in ROLES.items():
print(f"{role}: MFA {m}/{n} ({pct(m, n)}%), phishing-resistant {p}/{n}")
print(f"total: MFA {mfa}/{total} ({pct(mfa, total)}%), phishing-resistant {pr}/{total} ({pct(pr, total)}%)")
if __name__ == "__main__":
main()
Run with python3 lab_mfa.py. Verified output:
dentist: MFA 6/6 (100%), phishing-resistant 2/6
nurse: MFA 8/10 (80%), phishing-resistant 0/10
reception: MFA 5/8 (62%), phishing-resistant 0/8
manager: MFA 2/2 (100%), phishing-resistant 2/2
admin-it: MFA 2/2 (100%), phishing-resistant 2/2
total: MFA 23/28 (82%), phishing-resistant 6/28 (21%)
12.2 Interpreting results
The run shows total MFA coverage of 23 of 28 staff, 82 percent, and phishing-resistant methods for 6 of 28, 21 percent. Dentists, managers and IT are at 100 percent MFA. Nurses are at 8 of 10 and reception at 5 of 8, 62 percent. Managers and IT all have phishing-resistant methods, as planned. Tomas notes that reception's gap matters because receptionists handle patient contact details and receive many emails, including the kind that try to capture passwords. He shares the figures with the practice manager.
Reception's three staff without MFA are therefore the first to enrol.
12.3 Planning improvements
Tomas plans two steps. First, help the five remaining staff set up methods within two weeks, with the practice manager making it part of the rota. Second, offer passkeys to dentists, who access full clinical records, over the next quarter. He will rerun the report monthly. Measuring by role turns a single percentage into a clear to-do list, and the monthly rerun shows whether the plan is working. He also notes that methods for nurses can follow once reception is complete. The practice manager approves both steps and the dates, and Tomas adds them to the monthly report.
Worked example
MFA covers 23 of 28 staff (82%) and phishing-resistant methods 6 of 28 (21%); reception at 62% is the first priority.
Synthetic case. Counts and roles are synthetic.
Errors and limits
Reporting only overall coverage hides a weak role behind a good total.
Exercises
- EX045 — Total coverage. What was total MFA coverage? Rubric: 3 = 23 of 28, 82%;; 2 = 82%;; 1 = 100%;; 0 = none.
- EX046 — Weakest role. Which role had the lowest coverage? Rubric: 3 = reception, 5 of 8 (62%);; 2 = reception;; 1 = nurse;; 0 = none.
- EX047 — Phishing-resistant. How many had phishing-resistant methods? Rubric: 3 = 6 of 28, 21%;; 2 = six;; 1 = vague;; 0 = none.
- EX048 — Reception concern. Why does reception's gap matter? Rubric: 3 = handle patient contact data and many emails;; 2 = exposure;; 1 = vague;; 0 = none.
Synthesis
Coverage by role shows where to act first and lets progress be measured.
Continue studying — chapter 12 of 18
← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →