OpenCyber Academy
Technologist · Chapter 7 · English
Course code: OCA-073Chapter 07: OCA-073-C007

Chapter 7 — Identity and access foundations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Roles"]
  N2["7.2 Leavers"]
  N3["7.3 Multi-factor authentication"]
  N4["7.4 Reviews"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Roles"]
  N2["7.2 Leavers"]
  N3["7.3 Multi-factor authentication"]
  N4["7.4 Reviews"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 Roles]
    |
    v
[7.2 Leavers]
    |
    v
[7.3 Multi-factor authentication]
    |
    v
[7.4 Reviews]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) design roles for club and head office staff; (2) manage leavers; (3) apply multi-factor authentication.

7.1 Roles

Aisha designs roles: reception, personal trainer, club manager, head office support, marketing and IT. Trainers see bookings and workout data for their clients; reception sees bookings and membership status; marketing sees preferences but not workout data. She documents why each role needs its access. She meets each group to check the draft. Trainers point out that they sometimes cover classes for colleagues and need temporary access to those clients. Aisha adds a time-limited cover permission that expires after the class instead of giving trainers access to all members, which keeps access narrow while still letting the clubs run smoothly every day.

7.2 Leavers

Gyms have high staff turnover. Aisha finds forty active accounts belonging to former staff. She links account removal to the HR leaver process and runs a monthly check. She notes that stale accounts are a common route for misuse. She traces how the forty accounts arose. Club managers create staff accounts directly, but nobody told IT when staff left, and HR used a separate system. Linking the two means a leaver date in HR now disables the account automatically. The monthly check compares active accounts with the HR list and reports any difference to the club manager.

7.3 Multi-factor authentication

Aisha recommends multi-factor authentication for head office and manager accounts, which can export member lists. Reception accounts on shared screens use short sessions and badge login. Managers worry that extra login steps will slow busy shifts. Aisha runs a two-week trial in one club using an authenticator app and finds that managers log in only a few times per day, so the delay is small. Export rights are the main reason for the control, because an export can copy thousands of members in seconds.

7.4 Reviews

Aisha sets up quarterly access reviews for club managers. The first review corrects twenty-three accounts. She records results as evidence of accountability under Article 5(2). Each manager receives a list of the accounts in their club with roles and last login dates and must confirm or correct each one. The corrections include trainers with reception rights, a cleaner with a booking account and two managers who had transferred to other clubs. Aisha keeps the signed lists with dates as evidence of the review being done.

Worked example

Aisha defines six roles, removes forty former-staff accounts through HR linkage, adds multi-factor authentication for exporters and runs quarterly reviews.

Synthetic case. Accounts are synthetic; GDPR Article 5(2) is real.

Errors and limits

Reviews by busy managers can be rubber stamps; sample their answers.

Exercises

Worked answers

EX019. Bookings and workout data for their own clients.

EX020. Forty.

EX021. Head office and manager accounts with export rights.