Chapter 13 — Movers

Chapter 13 — Movers

Lesson map

Lesson 13 published. Map, example, EX037.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 Mover risk"]
  N2["13.2 Mover steps"]
  N3["13.3 Checking removal"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX037"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 Mover risk"]
  N2["13.2 Mover steps"]
  N3["13.3 Checking removal"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX037"]

[Learning outcomes]
    |
    v
[13.1 Mover risk]
    |
    v
[13.2 Mover steps]
    |
    v
[13.3 Checking removal]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX037]

Learning outcomes

You will (1) explain mover risk; (2) design mover steps; (3) check removal of old access.

13.1 Mover risk

When staff change role or clinic, they often gain new access while keeping the old. Over years this builds up so that long-serving staff hold far more than their current job needs. Kai finds a nurse who moved from reception still holding booking administration rights, and a vet who moved from the east to central clinic still in clinic-east-staff. Neither is malicious; both are simply leftovers. Mover handling is where least privilege most often quietly erodes. He discusses both cases with their managers before changing anything.

13.2 Mover steps

Kai's mover process starts from an HR change record. It lists the old role's groups and the new role's groups, removes what the new role does not need and adds what it does. Where a short overlap is genuinely needed, such as a handover week, the old access gets an end date. The manager confirms the result. This makes removal a planned part of every move rather than something somebody might remember months later. HR and IT agree the change record carries the move date and new role.

13.3 Checking removal

A week after each move, Kai's script compares the person's groups with their new role's groups and flags differences. In the first two months, five moves are processed; four are clean and one still has an old group because the overlap end date was not set. The fix is applied and the process updated so overlap without an end date is not accepted. Checking afterwards turns an intended process into a verified one. The weekly comparison takes the script a few seconds and a person a few minutes.

Worked example

Five moves are processed; four are clean and one retained old access, prompting a mandatory end date for overlaps.

Synthetic case. Staff and moves are synthetic.

Errors and limits

Adding new access on a move without removing old access accumulates privilege over years.

Exercises

• EX037 — Leftover examples. Give one leftover access example. Rubric: 3 = nurse kept booking admin rights;; 2 = leftover;; 1 = vague;; 0 = none.
• EX038 — Overlap rule. What rule applies to overlap access? Rubric: 3 = it must have an end date;; 2 = end date;; 1 = permanent;; 0 = none.
• EX039 — First results. How many of five moves were clean? Rubric: 3 = four;; 2 = 4;; 1 = five;; 0 = none.

Synthesis

Mover processes that remove old access and are checked afterwards prevent privilege build-up.

Continue studying — chapter 13 of 30

← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →