Chapter 3 — Operating systems and identities
Lesson map
Lesson 03 published. Map, example, EX009.
flowchart TD
N0["Learning outcomes"]
N1["3.1 Reviewing accounts"]
N2["3.2 Least privilege"]
N3["3.3 Shared-device sign-in"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX009"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 Reviewing accounts"]
N2["3.2 Least privilege"]
N3["3.3 Shared-device sign-in"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX009"]
[Learning outcomes]
|
v
[3.1 Reviewing accounts]
|
v
[3.2 Least privilege]
|
v
[3.3 Shared-device sign-in]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX009]
Learning outcomes
You will (1) review user accounts on practice PCs; (2) apply least privilege; (3) set up shared-device sign-in safely.
3.1 Reviewing accounts
Nadia reviews accounts on reception and surgery PCs. Most PCs sign in automatically to a shared practice account that has local administrator rights. Dentists and nurses then sign in to the cloud practice management system with personal accounts. The shared Windows account means anything downloaded runs with full rights, and there is no record of who used each PC. Grace explains it was set up years ago so that busy staff could start work quickly. Nadia documents the risk and the reason, because both matter for a fix.
3.2 Least privilege
Nadia proposes removing administrator rights from the shared account and keeping one separate administrator account used only by Grace for maintenance. She tests the imaging viewer and dental charting software under a standard account on one PC. One older charting program fails to save settings without administrator rights; the vendor provides a configuration fix that grants rights only to its own folder. Least privilege usually works after small adjustments, and testing on one PC first avoids disrupting a whole practice.
3.3 Shared-device sign-in
Surgery PCs are used by several people each day. Nadia suggests individual Windows accounts with fast sign-in using a PIN or badge, and automatic locking after five minutes idle. Grace pilots this in one practice. Staff complain at first, then adapt when sign-in takes under five seconds. Individual accounts mean that if a PC is misused, the record shows who was signed in. Nadia notes that convenience is a security requirement in clinics, because slow controls get bypassed. The pilot practice keeps notes on problems for the wider rollout.
Worked example
Nadia reviews a shared admin account, removes admin rights with a vendor fix for one program and pilots individual fast sign-in.
Synthetic case. Accounts and software are synthetic.
Errors and limits
Fast sign-in methods need lost-badge handling. Vendor fixes may change with updates.
Exercises
- EX009 — Shared account risk. Why is the shared administrator account risky? Rubric: 3 = downloads run with full rights and there is no record of users;; 2 = rights and accountability;; 1 = vague;; 0 = none.
- EX010 — Charting fix. How was the charting program fixed? Rubric: 3 = a vendor configuration granting rights only to its own folder;; 2 = folder rights;; 1 = admin rights;; 0 = none.
- EX011 — Lock timing. After how long do surgery PCs lock? Rubric: 3 = five minutes idle;; 2 = five;; 1 = vague;; 0 = none.
- EX012 — Convenience. Why is convenience a security requirement in clinics? Rubric: 3 = slow controls get bypassed;; 2 = bypass;; 1 = vague;; 0 = none.
Synthesis
Removing shared admin accounts and giving fast individual sign-in improves both security and accountability.
Continue studying — chapter 03 of 18
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →