◇ OpenCyber Academy
Technologist · Chapter 7 · English

Chapter 7 — Identity and access foundations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Identity and access foundations

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Who and what"]
  N2["7.2 Roles for depots"]
  N3["7.3 Joiners, movers and leavers"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Who and what"]
  N2["7.2 Roles for depots"]
  N3["7.3 Joiners, movers and leavers"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 Who and what]
    |
    v
[7.2 Roles for depots]
    |
    v
[7.3 Joiners, movers and leavers]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) explain authentication and authorisation; (2) design role-based access for depots; (3) handle joiners, movers and leavers.

7.1 Who and what

Ruth separates two questions. Authentication asks who you are, using something you know, have or are. Authorisation asks what you may do once known. Brightwater's drivers sign in to handhelds with a four-digit PIN shared by each van crew, so the company cannot tell which driver made a scan. Tomás recommends individual sign-in using a badge tap and a personal PIN. Individual identity is the foundation of accountability, because without it logs cannot show who did what and access cannot be removed for one person.

7.2 Roles for depots

Tomás designs roles: driver, sorter, depot supervisor, customer service, finance and administrator. Each role lists the permissions it needs. Supervisors can reassign parcels but not change customer addresses; customer service can change addresses but not reassign routes. He checks the design against real tasks by shadowing a supervisor for a shift. Role-based access keeps permissions understandable, so a new supervisor gets the right rights in one step instead of copying a colleague's account and inheriting their history. Agency workers receive the sorter role with an end date matching their contract.

7.3 Joiners, movers and leavers

Brightwater hires many seasonal staff before winter. Tomás writes a process: joiners get a role on their start date, movers lose old rights when they gain new ones, and leavers are disabled on their last day by a request from human resources. He notes that movers are often forgotten, so a sorter promoted to supervisor keeps sorter rights forever. Sam adds a quarterly review where supervisors confirm their team's access. A short documented process removes most of the access drift seen in small companies.

Worked example

Tomás replaces shared crew PINs with individual sign-in, designs six depot roles and writes a joiner, mover and leaver process with quarterly review.

Synthetic case. Roles and processes are synthetic.

Errors and limits

Badge loss creates support load. Reviews become rubber stamps without guidance.

Exercises

Synthesis

Individual identities, clear roles and a joiner, mover and leaver process are the foundation of access control.

Continue studying — chapter 07 of 30

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →

Worked answers

EX019. Because no one can tell which driver made a scan, and access cannot be removed for one person.

EX020. Supervisors cannot change customer addresses.

EX021. Because they often keep their old rights when they gain new ones.