A new starter on Monday
A new worker starts at a college. What should they be able to open? Who checked they are safe to hire? Who teaches them the rules?
Good security starts before a person logs in.
Today you learn six defences that deal with people and access.
By the end of this lesson
Note
I can explain the purpose, benefit and drawback of six defences that control people and access.
Key words
| Word | What it means | Example |
|---|---|---|
| User access policy | Written rules on who may use which systems and data. | |
| Least privilege | Giving each person only the access they need. | |
| Vetting | Checking a person is safe to employ before they start. | |
| Reference | A note from a past employer or teacher about a person. | |
| Staff training | Teaching staff the risks and the rules. | |
| Software-based access control | Settings in software that decide who may open, change or delete what. | |
| MFA | Multi-factor authentication: two or more proofs of who you are. | |
| Authentication | Proving you are who you say you are. | |
| Password manager | A program that stores strong, different passwords for you, behind one master password. | |
| Phishing | A fake message that tricks you into giving away data. | |
| Role | A job in a system that comes with set access. | teacher |
The cells students fill in are left blank in this preview.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: policies and access control
A user access policy says who may use what. It follows least privilege: each person gets only the access they need for their role.
A teacher opens marks. A student does not.
Software-based access control puts the policy into the system. The software checks every request against the rules. A student asking for the marks folder is refused.
Worked example: who may open what
| Role | Marks | Lessons | Settings |
|---|---|---|---|
| Student | No | Yes | No |
| Teacher | Yes | Yes | No |
| Admin | Yes | Yes | Yes |
The cells students fill in are left blank in this preview.
Cycle 2: vetting and training
Staff vetting means checking a person before they start: identity, references and, for some jobs, a criminal record check. Purpose: do not give access to a risky person.
Staff training teaches the rules and the risks: phishing, passwords, visitors. Purpose: fewer mistakes.
Both reduce the human threats you met earlier.
Check: policies, vetting and training
Have a go
Check: policies, vetting and training
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.