A new analyst on Monday
A new analyst starts at a firm. Which tables should they be able to open? Who checked they are safe to hire? Who teaches them the rules?
Good security starts before a person logs in.
Today you learn six defences that deal with people and access.
Key words
| Word | What it means | Example |
|---|---|---|
| User access policy | Written rules on who may use which systems and data. | |
| Least privilege | Giving each person only the access they need. | |
| Vetting | Checking a person is safe to employ before they start. | |
| Reference | A note from a past employer or teacher about a person. | |
| Staff training | Teaching staff the risks and the rules. | |
| Software-based access control | Settings in software that decide who may open, change or delete what. | |
| MFA | Multi-factor login: two or more proofs of who you are. | |
| Password manager | A program that stores strong, different passwords for you, behind one master password. | |
| Phishing | A fake message that tricks you into giving away data. | |
| Dashboard | A screen of live charts and figures. | |
| Role | A job in a system that comes with set access. | analyst |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can explain the purpose, benefit and drawback of six defences that control people and access.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Policies and access control
A user access policy says who may use what. It follows least privilege: each person gets only the access they need for their role.
An analyst opens the raw tables. A dashboard viewer does not.
Software-based access control puts the policy into the system. The software checks every request against the rules. A viewer asking for a raw table is refused.
Worked example: who may open what
| Role | Dashboards | Raw tables | Settings |
|---|---|---|---|
| Viewer | Yes | No | No |
| Analyst | Yes | Yes | No |
| Admin | Yes | Yes | Yes |
The cells students fill in are left blank in this preview.
Vetting and training
Staff vetting means checking a person before they start: identity, references and, for some jobs, a criminal record check. The purpose is not to give access to a risky person.
Staff training teaches the rules and the risks: phishing, passwords, visitors. The purpose is fewer mistakes.
Both reduce the human threats you met earlier.
Check: policies, vetting and training
Have a go
Check: policies, vetting and training
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.