Chapter 3 — Operating systems and identities
Lesson map
Lesson 03 published. Map, example, EX009.
flowchart TD
N0["Learning outcomes"]
N1["3.1 User accounts"]
N2["3.2 Least privilege"]
N3["3.3 Administrator access"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX009"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 User accounts"]
N2["3.2 Least privilege"]
N3["3.3 Administrator access"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX009"]
[Learning outcomes]
|
v
[3.1 User accounts]
|
v
[3.2 Least privilege]
|
v
[3.3 Administrator access]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX009]
Learning outcomes
You will (1) manage user accounts on business systems; (2) apply least privilege on computers; (3) control administrator access.
3.1 User accounts
Amina learns how Fenwick creates accounts for staff on office computers, tills and cloud services. Each person should have their own account so actions can be traced. At tills, staff share a till login, which makes it impossible to know who processed a refund. She recommends individual till logins with quick card sign-in. She learns that individual accounts are the basis of accountability, and that shared accounts usually exist because individual ones were inconvenient. Individual logins would also let a branch manager see which staff member processed each refund when a till total does not match.
3.2 Least privilege
Office computers give every user local administrator rights so they can install software. Amina explains that this lets malware install itself with full control. She proposes removing local administrator rights and providing a software request process. She tests the change on three computers first, finding that one accounting program needs a setting adjusted. She learns that least privilege must be introduced carefully with testing, so that work continues smoothly. Her three-computer pilot found the accounting program issue before it could stop a whole office.
3.3 Administrator access
IT technicians use administrator accounts for maintenance. Amina recommends separate administrator accounts used only for admin tasks, with multi-factor authentication and logging. She notes that if a technician's everyday account is compromised, attackers should not gain admin rights automatically. She learns that controlling administrator access is one of the most effective security measures, because most serious attacks depend on gaining those rights. Logging admin sessions also gives the IT lead a record to check when a setting changes unexpectedly. Every admin action thus carries a name the IT lead can review.
Worked example
Amina replaces shared till logins, removes local admin rights after testing and separates administrator accounts with MFA.
Synthetic case. Accounts and systems are synthetic.
Errors and limits
Removing rights can break software. Card sign-in needs hardware.
Exercises
- EX009 — Shared till problem. Why is a shared till login a problem? Rubric: 3 = cannot trace who processed a refund;; 2 = accountability;; 1 = vague;; 0 = none.
- EX010 — Admin rights risk. Why remove local administrator rights? Rubric: 3 = malware could install itself with full control;; 2 = malware;; 1 = vague;; 0 = none.
- EX011 — Separate admin. Why use separate administrator accounts? Rubric: 3 = compromise of an everyday account should not give admin rights;; 2 = separation;; 1 = vague;; 0 = none.
- EX012 — Testing first. Why test removal of rights on three computers first? Rubric: 3 = to find software that breaks;; 2 = pilot;; 1 = vague;; 0 = none.
Synthesis
Individual accounts, least privilege and separate admin access underpin technical governance.
Continue studying — chapter 03 of 18
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →