Design permissions for a stated organisation and prove the result

applied · 50 min · Objective 2.1

Task

Take a written requirement for four groups of people and a folder structure, design the permissions, implement them on the guest, and then prove the design by testing every requirement -- including the ones that say somebody must NOT have access, which are the ones designs usually fail.

Steps

  1. Write the requirement in lab/permdesign/requirement.md: four groups, a folder structure of at least four folders, and at least eight statements of the form 'X must be able to' or 'X must not be able to'.
  2. Design the permissions in lab/permdesign/design.csv with header folder,principal,ntfs,share,inherited and implement them.
  3. Write lab/permdesign/tests.csv with header requirement,principal,folder,expected,actual,pass with one row per requirement statement, including every 'must not' case.
  4. Test each row as the relevant account and fill in actual and pass.
  5. Write lab/permdesign/review.md naming any place you used a deny, why, and what you would have done instead -- and stating how someone would answer 'what can this person reach?' from your design.

Verify

grep -Ec 'must' lab/permdesign/requirement.md
awk -F, 'NR>1 && NF>=5 {n++} END {print n" permission row(s)"}' lab/permdesign/design.csv
awk -F, 'NR>1 && NF>=6 {n++} END {print n" test(s)"}' lab/permdesign/tests.csv
awk -F, 'NR>1 && $4 ~ /deny|refus|no/ {n++} END {print n" negative requirement(s) tested"}' lab/permdesign/tests.csv
awk -F, 'NR>1 && $6 ~ /no|fail/ {n++} END {print n" failing test(s)"}' lab/permdesign/tests.csv
grep -Eic 'group|deny' lab/permdesign/review.md

Eight requirement statements, a test per statement, and at least two negative requirements tested. A test set with no negative cases has only proved that access was granted, which is the easy half.

Notes

Granting to groups rather than to individuals is what makes the last question answerable. A design that grants to named accounts works perfectly and cannot be audited, which is how estates end up unable to say who can reach what.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.