Chapter 7 — Identity and access foundations | Technologist Cryptography and trust services

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Identity and access foundations

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Identities and credentials"]
  N2["7.2 Multi-factor rollout"]
  N3["7.3 Joiners, movers and leavers"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Identities and credentials"]
  N2["7.2 Multi-factor rollout"]
  N3["7.3 Joiners, movers and leavers"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 Identities and credentials]
    |
    v
[7.2 Multi-factor rollout]
    |
    v
[7.3 Joiners, movers and leavers]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) explain how certificates and tokens identify users and devices; (2) configure multi-factor authentication for staff; (3) manage access changes when staff move or leave.

7.1 Identities and credentials

Rosa learns that identities can be proven with passwords, one-time codes, security keys and certificates. The council's staff VPN uses device certificates issued by an internal certificate authority plus a staff password and one-time code. The certificate shows the device is council-managed; the password and code show the person is authorised. Rosa explains to new staff that losing a laptop therefore requires both revoking the device certificate and checking the account, because the two credentials prove different things. Rosa also notes that each credential type has a different lifetime and revocation path, which must be written beside it in the inventory.

7.2 Multi-factor rollout

Owen asks Rosa to help roll out phishing-resistant security keys for administrators. Security keys sign a challenge that includes the website's origin, so a fake login page cannot reuse the response. Rosa prepares instructions, registers two keys per administrator so a lost key does not lock anyone out and tests recovery. She keeps one-time codes as a fallback for staff without security keys. She tracks adoption weekly and reaches all administrators within a month. She tracks enrolment weekly, chasing the last few teams personally, because a rollout that stalls at ninety percent leaves the weakest accounts unprotected.

7.3 Joiners, movers and leavers

Access must change when staff join, change roles or leave. Rosa reviews the council's process and finds that device certificates for leavers were sometimes not revoked for weeks. She adds a step to the leaver checklist that revokes the certificate and disables tokens on the last working day, and a monthly report comparing active certificates with the staff directory. She learns that cryptographic credentials are only as good as the processes that issue and withdraw them. Leaver processing is checked monthly against the human resources list, and any certificate still valid for a departed person is revoked the same day.

Worked example

Rosa explains device certificates versus personal credentials, rolls out two security keys per administrator, and adds certificate revocation to the leaver checklist with a monthly reconciliation.

Synthetic case. Processes and figures are invented.

Errors and limits

Strong authentication does not limit what an authenticated user may do. Spare security keys must themselves be stored securely.

Exercises

EX019 — Two credentials. What do the device certificate and the password-plus-code each prove? Rubric: 3 = certificate: council-managed device; password and code: authorised person;; 2 = both;; 1 = one;; 0 = none.
EX020 — Two keys. Why register two security keys per administrator? Rubric: 3 = so a lost key does not lock them out;; 2 = backup;; 1 = security;; 0 = none.
EX021 — Leaver gap. What gap did Rosa find in the leaver process? Rubric: 3 = device certificates not revoked for weeks;; 2 = delay;; 1 = vague;; 0 = none.

Synthesis

Certificates and tokens identify devices and people, but issuance and revocation processes decide their real strength.

Continue studying — chapter 07 of 30

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →