◇ OpenCyber Academy
Technologist · Chapter 7 · English

Chapter 7 — Identity and accounts

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Identity and accounts

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Lifecycle"]
  N2["7.2 Multi-factor authentication"]
  N3["Lab — Finding stale accounts"]
  N4["7.3 Reading the result"]
  N5["7.4 Leavers process"]
  N6["Service accounts"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Lifecycle"]
  N2["7.2 Multi-factor authentication"]
  N3["Lab — Finding stale accounts"]
  N4["7.3 Reading the result"]
  N5["7.4 Leavers process"]
  N6["Service accounts"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 Lifecycle]
    |
    v
[7.2 Multi-factor authentication]
    |
    v
[Lab — Finding stale accounts]
    |
    v
[7.3 Reading the result]
    |
    v
[7.4 Leavers process]
    |
    v
[Service accounts]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) describe the account lifecycle; (2) explain multi-factor authentication; (3) find stale accounts.

7.1 Lifecycle

Accounts should follow people: created when someone joins, changed when their role changes and disabled when they leave. In schools, supply teachers and temporary staff come and go often, which is exactly where the trust's earlier problem arose. CIS Controls v8 Control 5 covers account management and Control 6 covers access control.

The trust's earlier problem was a supply teacher whose account outlived the contract by months, because nothing told Dev the person had gone. For each stage Tomás writes who triggers the change: the school office for joiners and leavers, and the head teacher for role changes such as becoming a class teacher or leaving the leadership team.

7.2 Multi-factor authentication

A password alone can be guessed or phished. Multi-factor authentication adds a second factor, such as an app approval or a security key. The trust uses it for email and remote access but not yet for administrator accounts on servers, which Tomás notes as a gap.

Administrator accounts on servers are the most valuable to an attacker, since they reach pupil records on mis01 and every staff document on files01. Without a second factor, a phished administrator password could open them directly. Tomás records the gap with the servers affected rather than proposing a product, so Dev can choose a method that works with the existing directory.

Lab — Finding stale accounts

"""Find stale accounts in a synthetic directory export (stdlib only)."""
import datetime as dt
today = dt.date(2026, 5, 1)
acc = [("j.byrne","2026-04-28",True),("k.osei","2025-11-02",True),("temp.supply","2025-09-30",True),
       ("m.lund","2026-04-30",True),("old.head","2024-07-15",True),("lab.admin","2026-01-20",True),
       ("p.ward","2026-04-29",True),("a.nolan","2025-12-01",False)]
stale = [u for u, d, en in acc if en and (today - dt.date.fromisoformat(d)).days > 90]
print(f"enabled accounts {sum(1 for a in acc if a[2])}; stale over 90 days {len(stale)}: {stale}")

Run with python3 lab_stale.py. Verified output:

enabled accounts 7; stale over 90 days 4: ['k.osei', 'temp.supply', 'old.head', 'lab.admin']

7.3 Reading the result

The synthetic export shows seven enabled accounts, four not used for over ninety days: a former teacher, a supply account, a former head teacher's account and a shared lab administrator account. Each needs a decision. Some may be needed occasionally; most should be disabled. The disabled account a.nolan is correctly excluded.

The lab's ninety-day threshold flags lab.admin at 101 days, only just over the line, while old.head has not been used for 655 days. Sorting by age would therefore put the oldest risks first. The count of four is what Tomás records as the starting value for stale accounts, using the same export and threshold he will use again at the end.

7.4 Leavers process

The fix is not only cleaning up once but making leavers trigger account disabling. Tomás drafts a simple form that the school office sends to Dev on a person's last day, with a weekly check of the stale list as a safety net.

The form asks for the person's name, last working day, which accounts they used and whether colleagues need any of their files. Dev disables the account on that day and records the date, so the weekly stale check should then find nothing new from leavers. Any account it does flag shows where the form was missed, which tells the office which step to fix.

Service accounts

Some accounts belong to programs rather than people: the backup software, the scanner that saves to a shared folder and the management information system's database connection. These service accounts are easy to forget because nobody signs in with them, yet they often have broad rights and passwords that never change. Each should have only the rights its program needs, a long random password stored in the password manager, and a named owner who reviews it yearly. Tomás lists the trust's five service accounts and finds that the scanner account is a domain administrator, which is far more than saving files needs. Dev reduces it to write access on one folder.

Worked example

Dev and the head teacher review the four stale accounts: three are disabled immediately, and lab.admin is replaced by named admin accounts for the two people who use it.

Synthetic case. Accounts are synthetic.

Errors and limits

Deleting accounts immediately can lose files that colleagues need; disabling first, then deleting after a retention period, is safer.

Exercises

Synthesis

Account hygiene depends on a lifecycle process plus a regular check for what the process missed.

Continue studying — chapter 07 of 30

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →