◇ OpenCyber Academy
Technologist · Chapter 7 · English

Chapter 7 — Identity and access foundations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Identity and access foundations

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Who are you, what may you do"]
  N2["7.2 Least privilege"]
  N3["7.3 Administrator accounts"]
  N4["7.4 Account lifecycle"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Who are you, what may you do"]
  N2["7.2 Least privilege"]
  N3["7.3 Administrator accounts"]
  N4["7.4 Account lifecycle"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 Who are you, what may you do]
    |
    v
[7.2 Least privilege]
    |
    v
[7.3 Administrator accounts]
    |
    v
[7.4 Account lifecycle]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) distinguish authentication and authorisation; (2) apply least privilege; (3) manage accounts and administrator access.

7.1 Who are you, what may you do

Authentication checks identity, usually with a password and ideally a second factor. Authorisation decides what an authenticated user may do. At the school, students, teachers, office staff and the technician need different access. Tomás finds that the staff wireless uses a single shared passphrase that several students have learned, so it authenticates no one reliably. He recommends moving staff wireless to individual accounts, so each connection is tied to a person and leavers can be removed individually. Guests keep a separate, simpler network.

7.2 Least privilege

Least privilege means giving each user only the access they need. Teachers need the learning platform and shared teaching files; office staff need finance and records systems; students need the internet and learning platform. Tomás finds several teachers are in an administrator group on the file server, added years ago to fix a printing problem. He recommends removing them and solving the printing problem properly. Excess privilege is often added for convenience and rarely removed, which slowly widens access well beyond what anyone intended.

7.3 Administrator accounts

Administrator accounts can change systems and the network, so they need special care. Tomás recommends that Gareth uses a separate administrator account only for administrative tasks, with a second factor, and an ordinary account for email and browsing. This limits harm if his ordinary account is phished. Administrator logins are logged centrally. He also suggests a sealed record of emergency credentials kept by the head teacher, so the school is not locked out if Gareth is unavailable during an emergency.

7.4 Account lifecycle

Accounts must be created, changed and removed as people join, move and leave. Schools have predictable cycles: students join and leave each year, and staff change at term boundaries. Tomás proposes a review at the start of each term comparing accounts with current student and staff lists from the school office. In his first review, he finds 37 accounts for students who left last summer and two for former staff. Regular, scheduled reviews catch such leftovers before they can be misused.

Worked example

The term review finds 39 leftover accounts, and four teachers are removed from the file server administrator group.

Synthetic case. Accounts are synthetic.

Errors and limits

Privileges added to fix one-off problems often remain for years.

Exercises

Synthesis

Individual authentication, least privilege and regular account reviews keep access aligned with need.

Continue studying — chapter 07 of 30

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →