English:Password and Access Management
Password and Access Management
Introduction
Passwords and access rights protect workplace systems, customer information, production data, learning platforms, email, cloud services, and connected equipment. As an apprentice, trainee, or vocational student, you may receive accounts for several systems and may later gain additional permissions. Secure use of those accounts is part of professional responsibility.
This aiMOOC helps you understand how passwords, password managers, multi-factor authentication, passkeys, and identity and access management work together. You will also practise recognizing phishing, applying the principle of least privilege, and handling account changes safely.
Learning goals: By the end of the course, you should be able to create and handle strong credentials, use an approved password manager, explain authentication and authorization, choose stronger MFA methods, apply least privilege to workplace scenarios, recognize common access-related attacks, and respond correctly when an account may be compromised.
Why Password and Access Management Matters at Work
A password is only one part of access security. A workplace must know who is requesting access, verify that identity, decide what the person is allowed to do, and remove access when it is no longer needed. These steps support confidentiality, integrity, availability, accountability, and safe business operations.
In a workshop, office, hospital, hotel, warehouse, laboratory, retail business, or industrial setting, excessive or outdated permissions can create real risks. A former trainee account that remains active, a shared administrator password, or a reused password can allow unauthorized access. Good access management reduces these risks without preventing people from doing their jobs.
A useful distinction is:
- Identification: You claim an identity, for example with a username or employee ID.
- Authentication: The system verifies that claim with one or more authenticators.
- Authorization: The system decides which resources and actions the authenticated identity may use.
- Accounting: Logs and reviews record relevant access events for security, troubleshooting, and compliance.
Password Fundamentals
Long, Unique, and Hard to Guess
A good workplace password should be unique to one account and difficult for another person or automated attack to guess. Current NIST guidance emphasizes length and blocklists of common or compromised passwords rather than mandatory mixtures of upper-case letters, lower-case letters, numbers, and symbols. For a password used as the only authentication factor, NIST SP 800-63B requires a minimum of 15 characters for systems following that standard. Passwords used only as part of multi-factor authentication may be shorter under the standard, but must be at least eight characters. Always follow your organization's policy when it is stricter.
A passphrase can make a long password easier to remember. It should not be a famous quotation, predictable slogan, personal detail, or sequence that coworkers could guess. Never use examples from training materials as real passwords.
Do not reuse passwords. If one service is breached, attackers may try the same username and password on other services. This attack is called credential stuffing. Reuse turns one compromise into a possible chain of compromises.
NIST also advises against routine forced password changes when there is no evidence of compromise. If you are an end user, follow your employer's policy. If a password is exposed, suspected of being stolen, or known to be compromised, change it promptly and follow incident-reporting procedures.
Use an Approved Password Manager
A password manager can generate and store long, unique passwords so that you do not need to memorize every credential. In a workplace, use the password manager approved by your employer or training organization. Do not move company credentials into a personal password manager unless policy explicitly allows it.
Protect the password manager itself with a strong master password or passphrase and MFA when supported. Lock your device when you step away, keep the manager and operating system updated, and follow backup or recovery procedures set by your organization.
The image shows an example interface of the free KeePass password manager. Different organizations may use different approved tools.
A password generator can create high-entropy credentials without relying on human patterns. For shared business secrets, service-account credentials, API keys, or administrative secrets, organizations may use dedicated enterprise vaults or secrets-management systems instead of ordinary personal password storage.
Multi-Factor Authentication and Passkeys
Multi-factor authentication, or MFA, requires two or more authentication factors from different categories. Typical categories are something you know, something you have, and something you are. A password plus another password is not MFA because both are the same factor type.
MFA makes account takeover harder when a password is stolen. However, MFA methods differ in strength. Text-message codes and manually entered one-time codes can still be phished. Push notifications can be abused through repeated approval requests, sometimes called MFA fatigue. Never approve an unexpected prompt.
Phishing-resistant methods such as FIDO2 or WebAuthn security keys and properly implemented passkeys bind authentication to the legitimate service and are designed to resist credential phishing. Use the strongest method your organization supports, especially for administrative or remote access.
A physical security key is an example of a possession-based authenticator. Do not lend a workplace security key to another person. Report a lost key immediately so that it can be disabled or replaced according to policy.
Recovery matters too. Strong authentication can be weakened by a poor recovery process. Store recovery codes as instructed, keep recovery channels current, and never bypass identity checks just because a request appears urgent.
Access Management in the Workplace
Least Privilege and Role-Based Access Control
The principle of least privilege means that a person or system should receive only the access needed for the assigned task, for only as long as it is needed. This limits accidental changes and reduces the impact of a compromised account.
Role-based access control, or RBAC, groups permissions around job roles. For example, a warehouse trainee may need to view stock levels and record receipts but may not need permission to change supplier bank details. A supervisor may have additional approval rights. A system administrator may need powerful technical permissions, but those rights should be separated from ordinary day-to-day work where practical.
Separation of duties can require two different people to complete sensitive actions. For example, one employee may enter a payment while another approves it. This reduces the chance that one compromised or misused account can complete a high-risk process alone.
Joiner, Mover, and Leaver Lifecycle
Access must change when a person's work changes. This is often described as the joiner, mover, and leaver lifecycle.
- Onboarding: Create the required account, verify the person's identity, assign the correct role, enroll approved MFA, and explain security responsibilities.
- Role change: Add access that is genuinely needed for the new role and remove permissions that are no longer necessary.
- Offboarding: Disable or remove access promptly, recover organization-owned authenticators or devices, transfer business-owned data appropriately, and revoke active sessions where required.
- Access review: Periodically verify that accounts, groups, roles, and privileged rights are still necessary and assigned to the correct people.
Leaving old permissions in place creates privilege accumulation. Good access management treats removal as seriously as granting access.
Privileged, Shared, and Service Accounts
A privileged account can make high-impact changes. Use privileged access only when required and follow your organization's approval and logging procedures. Where the organization provides separate administrator and standard accounts, use the standard account for ordinary email, web browsing, and routine work.
Avoid shared personal accounts. Individual accounts improve accountability because actions can be linked to the correct user. If a technical process requires a service account, its credential should be stored and rotated according to organizational controls, not copied into chat messages, notebooks, source code, or unsecured files.
Emergency or break-glass accounts should be tightly controlled, monitored, and used only under defined emergency procedures. Their existence does not justify bypassing normal security controls.
Phishing and Social Engineering
Phishing attempts to trick you into revealing credentials, approving an MFA request, opening a malicious attachment, or visiting a fake login page. Messages may create urgency, fear, curiosity, or authority pressure. Modern phishing can be well written, so poor spelling is not a reliable test.
Before entering a workplace password, check that you reached the expected service through a trusted route. Be cautious with unexpected password-reset messages, QR codes, shortened links, unusual login pages, and requests to bypass normal procedures. If a message claims to come from a supervisor or IT support and asks for a password or MFA code, verify the request through an approved independent channel.
Never disclose a password, one-time code, recovery code, or security-key approval to someone who asks for it. Legitimate support processes should not require you to reveal your password.
Password Recovery and Incident Response
If you think a workplace account may be compromised, speed and correct escalation matter. Follow your organization's incident procedure rather than trying to investigate secretly on your own.
A typical safe response is to stop using suspicious links or prompts, contact the authorized help desk or security team through a known channel, change the affected password from a trusted device when instructed, revoke active sessions if the system supports it, review MFA methods and recovery options, and check for unauthorized changes. If the same password was reused elsewhere, those other accounts may also need action.
Do not delete suspicious messages or logs if your organization may need them as evidence. Do not forward malicious attachments casually. Use the approved reporting function or incident channel.
Practical Workplace Checklist
Use this checklist whenever you receive or manage access:
- Account ownership: Use your own assigned account and never impersonate another worker.
- Password hygiene: Use a unique, long password or an approved generated credential for every password-based account.
- Password manager: Store workplace credentials only in an approved manager or vault.
- Multi-factor authentication: Enroll the strongest approved MFA method and reject unexpected prompts.
- Least privilege: Ask only for the permissions required for your current task.
- Access review: Report access that looks excessive, outdated, or assigned to the wrong person.
- Phishing awareness: Verify unexpected login, reset, or MFA requests through a trusted route.
- Incident reporting: Report lost authenticators, suspicious sign-ins, or exposed credentials immediately.
Reliable Guidance and Further Reading
The course content is aligned with current authoritative guidance. For deeper study, use these resources:
- NIST SP 800-63B Authentication and Authenticator Management: Technical requirements and guidance on passwords, authenticators, MFA, recovery, and authentication assurance.
- NIST How Do I Create a Good Password: Practical advice on password length, password managers, passphrases, and MFA.
- CISA Require Multifactor Authentication: Workplace guidance on adopting MFA and stronger phishing-resistant options.
- CISA Hardening Guidance: Guidance that includes RBAC, least privilege, account reviews, and phishing-resistant MFA.
- Identity and access management on Wikipedia: A useful overview with links to related concepts and references.
Interactive Tasks
Quiz: Test Your Knowledge
What is the main purpose of least privilege? (Give users only the access needed for their tasks) (!Give every employee administrator rights) (!Keep all accounts active permanently) (!Use one shared password for the whole team)
Why is password reuse dangerous? (A stolen password may unlock several accounts) (!It makes a password too long to type) (!It prevents multi-factor authentication) (!It automatically deletes account logs)
What is a main benefit of an approved password manager? (It can generate and store unique passwords securely) (!It makes every account use the same password) (!It removes the need for device security) (!It guarantees that phishing cannot happen)
Which example is multi-factor authentication? (A password plus a physical security key) (!A password plus another password) (!A username plus an email address) (!Two security questions)
Which option is designed to provide phishing-resistant authentication? (A FIDO2 security key) (!A password hint) (!A shared spreadsheet of passwords) (!An emailed one-time code)
What does role-based access control do? (Assigns permissions according to defined job roles) (!Gives every user the same permissions) (!Disables logging for privileged users) (!Replaces identity verification with trust)
What should happen when a trainee changes to a different role? (Old unneeded permissions should be removed) (!All previous permissions should always be kept) (!The trainee should borrow a supervisor account) (!The account should be shared with the replacement)
What should you do with an unexpected password-reset message? (Verify it through a trusted route before acting) (!Enter your password immediately) (!Send the message to every coworker) (!Approve any MFA prompt that follows)
Why are individual workplace accounts preferable to shared personal accounts? (They improve accountability for user actions) (!They make access reviews unnecessary) (!They allow passwords to be posted publicly) (!They remove the need for authorization)
What is an appropriate first action after noticing a suspicious sign-in to a work account? (Follow the approved incident-reporting procedure) (!Ignore it until the next password rotation) (!Delete all evidence immediately) (!Share the account with a colleague for testing)
Memory Game
| Passphrase | A long password made from several words or components |
| MFA | Verification using more than one authentication factor |
| RBAC | Permission assignment based on defined job roles |
| Least privilege | Access limited to what a task genuinely requires |
| Credential stuffing | Automated use of stolen credentials on other services |
| Deprovisioning | Removal or disabling of access that is no longer needed |
Drag and Drop
| Match the correct terms. | Topic |
|---|---|
| Authentication | Proving that a claimed identity is genuine |
| Authorization | Deciding which resources and actions an identity may use |
| Provisioning | Creating an account and assigning approved access |
| Deprovisioning | Removing access when it is no longer required |
| Auditing | Reviewing records and permissions to check appropriate use |
Match each security process to the workplace action it describes.
Crossword Puzzle
| Passphrase | What long memorable secret can be built from several words? |
| Phishing | What attack uses deceptive messages or login pages to steal credentials? |
| Biometrics | What factor type can use a fingerprint or face characteristic? |
| Authorization | What process decides what an authenticated user may do? |
| Provisioning | What process creates accounts and assigns approved access? |
| Credential | What general term describes information or an authenticator used to prove identity? |
LearningApps
Cloze Text
Open-Ended Tasks
Easy
- Password manager: Explore an approved or demonstration password manager and create a short illustrated guide that explains how to generate a unique password without revealing any real credential.
- Phishing: Mark the warning signs in a fictional phishing message and explain which trusted channel you would use to verify the request.
- Multi-factor authentication: Create a one-page poster comparing a password, an authenticator app, and a physical security key for vocational learners.
- Access control: Interview a trainer or supervisor about how new users receive access in your learning or workplace environment without asking for any secret credentials.
Standard
- Role-based access control: Design a small access matrix for three fictional workplace roles and justify which files, applications, or machines each role should be allowed to use.
- Joiner mover leaver: Produce a flowchart for onboarding, role changes, and offboarding in a fictional company, including approval, MFA enrollment, and access removal.
- Password policy: Compare a fictional old-style complexity policy with current NIST-oriented password guidance and write a recommendation for a small business.
- Cybersecurity awareness: Record a two-minute training video that teaches apprentices how to respond to an unexpected MFA prompt or password-reset message.
Advanced
- Identity and access management: Build a documented IAM plan for a fictional vocational workshop, including roles, privileged access, review intervals, and emergency access.
- Principle of least privilege: Conduct a permission-review exercise using only fictional accounts, identify excessive access, and propose a safer role design.
- Incident response: Run a tabletop exercise in which a trainee account is suspected of compromise and produce an incident timeline, communication plan, and recovery checklist.
- Authentication: Compare password plus one-time code, passkey, and hardware security-key approaches for a remote-work scenario and present a risk-based recommendation.
Learning Assessment
- Access design assessment: Given a fictional small business with office staff, apprentices, supervisors, and an external contractor, design access roles and justify each permission using least privilege.
- Credential compromise assessment: Analyze a scenario in which one reused password appears in a breach and explain the sequence of containment, recovery, and prevention actions you would recommend.
- MFA decision assessment: Compare three available MFA methods for a high-value administrative account and defend the strongest practical choice against phishing and account takeover.
- Lifecycle assessment: Evaluate a flawed joiner-mover-leaver process, identify where unnecessary access can accumulate, and redesign the process to reduce risk.
- Phishing response assessment: Examine a realistic but fictional password-reset message, explain which signals require verification, and design a safe reporting and verification path.
- Workplace transfer assessment: Apply the same access-management principles to a different vocational setting, such as healthcare, manufacturing, hospitality, logistics, or retail, and explain what changes and what stays the same.
Evidence of Learning
Knowledge: You can distinguish identification, authentication, authorization, accounting, passwords, passphrases, MFA, passkeys, RBAC, least privilege, provisioning, deprovisioning, privileged access, phishing, and credential stuffing.
Skills: You can choose and handle credentials safely, use an approved password manager, compare MFA methods, recognize suspicious login requests, map roles to permissions, review access, and follow a structured incident-reporting process.
Products: Useful evidence can include a password-manager guide using dummy data, a phishing-analysis poster, an IAM role matrix, a joiner-mover-leaver flowchart, a short training video, an access-review report, or a tabletop incident record.
Transfer: Strong evidence shows that you can apply the same principles to a new workplace, system, or job role and explain how security controls should change when the risk, data sensitivity, or responsibility level changes.
Professional behavior: You protect secrets, use only authorized access, report mistakes or suspicious events promptly, respect privacy, and avoid bypassing controls for convenience.
OERs on the Topic
Linked Learning Areas
The topic connects cybersecurity with information security, computer science, workplace communication, compliance, risk management, and professional responsibility. In vocational education, these links are especially useful because access decisions affect real tools, business processes, customer data, and safety-critical operations.
aiMOOC Projects
MOOCwiki · Deutsch
Nach dem Lernen ist vor dem Lernen
Entdecke direkt den nächsten Lernkurs. Weitere Inhalte erscheinen, wenn Du weiter nach unten scrollst.
Zur MOOCwiki-HauptseiteMediathek
Mediathek
Mediathek wird aus dem Wiki geladen ...
Keine passenden Inhalte gefunden. Bitte ändere Suche oder Filter.