◇ OpenCyber Academy
Technologist · Chapter 23 · English

Chapter 23 — Access review lab

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 23 — Access review lab

Lesson map

Lesson 23 published. Map, example, EX067.

flowchart TD
  N0["Learning outcomes"]
  N1["23.1 The summary"]
  N2["Lab — Review summary"]
  N3["23.2 Interpreting the results"]
  N4["23.3 Following up"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX067"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["23.1 The summary"]
  N2["Lab — Review summary"]
  N3["23.2 Interpreting the results"]
  N4["23.3 Following up"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX067"]
[Learning outcomes]
    |
    v
[23.1 The summary]
    |
    v
[Lab — Review summary]
    |
    v
[23.2 Interpreting the results]
    |
    v
[23.3 Following up]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX067]

Learning outcomes

You will (1) run an access review summary on synthetic data; (2) interpret completion and removals; (3) follow up gaps.

23.1 The summary

Fernhill now reviews access each quarter: group owners confirm or remove each member. For the review campaign, Kai's standard-library tool takes a synthetic review export and reports how many items were reviewed, how many removals were made and completion by clinic. It reads only synthetic review data and reports figures that he checks before sharing with managers, so the numbers support a conversation rather than replace it. Reviewers receive a short guide explaining what to check. The guide asks them to remove anything they cannot explain. Kai tests the script on known data first.

Lab — Review summary

"""Access review results by clinic manager: completion and removals (stdlib only)."""
rev = {"north": (42, 42, 5), "south": (38, 38, 3), "east": (35, 20, 0), "west": (30, 30, 4), "central": (40, 40, 6)}
tot = sum(r[0] for r in rev.values()); done = sum(r[1] for r in rev.values()); rem = sum(r[2] for r in rev.values())
for k, (n, d, r) in rev.items(): print(f"{k:8} items={n} reviewed={d} ({100*d/n:.0f}%) removed={r}")
print(f"total items={tot} reviewed={done} ({100*done/tot:.0f}%) removed={rem} ({100*rem/done:.1f}% of reviewed)")

Run with python3 lab_review.py. Verified output:

north    items=42 reviewed=42 (100%) removed=5
south    items=38 reviewed=38 (100%) removed=3
east     items=35 reviewed=20 (57%) removed=0
west     items=30 reviewed=30 (100%) removed=4
central  items=40 reviewed=40 (100%) removed=6
total items=185 reviewed=170 (92%) removed=18 (10.6% of reviewed)

23.2 Interpreting the results

The run reports 170 of 185 items reviewed, 92 percent, with 18 removals, 10.6 percent of reviewed items. Every clinic is complete except east, at 20 of 35. Kai notes that 18 removals is a healthy sign that reviewers are looking rather than approving everything, while an incomplete clinic means some access went unchecked. He does not treat 92 percent as success while one clinic remains well behind the others. He also checks whether removals cluster in one group. They do not, which suggests the reviews were careful.

East's 15 unreviewed items become the first follow-up task.

23.3 Following up

Kai meets the east clinic manager, who explains that she was on leave during the review window. They agree a deputy reviewer for future absences and complete the remaining 15 items within a week, which brings two further removals. Kai records the reason and the fix. He also suggests reminding reviewers a week before the deadline. Following up specific gaps is more useful than reporting a single overall percentage. The reminder is added to the review runbook. Kai checks the deputy arrangement at the next review.

Worked example

The review reaches 170 of 185 items (92%), with 18 removals; east finishes after a deputy reviewer is appointed.

Synthetic case. Review figures are synthetic.

Errors and limits

Reporting only overall completion hides a clinic that did not review.

Exercises

Synthesis

Review summaries by clinic, plus follow-up of gaps, make reviews complete and meaningful.

Continue studying — chapter 23 of 30

← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →