Lion Cipher Lab
Mine least-privilege roles and catch toxic combinations (identity governance from scratch)
- Identity & Access Management
- Advanced
- ~120 min
- Free · no account required
Why it matters
Almost every organization runs access reviews, and almost none of them measure anything. Somebody exports a list of who is in which group, mails it to managers, the managers click Approve, and a control is marked green. That process is not wrong so much as blind: it moves entitlements around and eyeballs them, and it cannot answer the questions that actually matter. How much of the access you have granted is never used? Which of your leavers still hold live privileges because the account was disabled but never deprovisioned? Which single person can both create a supplier and approve the…
What you'll learn
- reading an entitlement estate as DATA: users.csv, groups.csv, grants.csv and a usage log, and what each one is in a real org
- flattening nested group membership into a user x permission matrix, and why the flattened truth is bigger than the group export looks
- handling a group cycle: why naive recursion raises RecursionError, and the visited-set fix that terminates on any graph
- measuring over-provisioning honestly: unused-entitlement ratio, orphaned grants on disabled accounts, department-outlier grants
- writing a role miner from scratch: department base roles, residual clustering, Jaccard similarity, and a majority cut-off for the role definition
- the role-explosion boundary: sweeping the Jaccard threshold and reading the knee where more roles stop buying coverage
- the thesis: mining roles from current grants launders drift into a certified role -- measured against mining from usage
- segregation-of-duties detection at three depths: single-group, direct membership, and nesting-resolved
- SoD conflicts that the role model itself CREATES by rounding role definitions up
- compensating controls as first-class dated objects, and what an expired control silently does to your metrics
Steps in this lab
- What this lab does that an access review does not
- Open a terminal and check Python (zero-assumption setup)
- The raw material: the four exports an IGA tool actually eats
- Write mkestate.py — generate the estate (seeded, so your numbers match)
- Write iga.py — the whole analysis in one file
- Failure mode (a): the group cycle, and flattening to the truth
- Measure over-provisioning honestly: unused, orphaned, outlier
- Role mining from scratch — and why explainable beats fancy
- Failure mode (b): role explosion — sweep theta and find the knee
- The thesis: mining the drift launders over-permission into a certified role
- Segregation of duties: the violations a spreadsheet cannot find
- Mitigate vs remediate: compensating controls as dated objects
- The certification campaign: volume is not the same as governance
- Failure mode (e): deny grants, and why an allow-only matrix lies
- When you would reach for role mining, and when you would not
- When NOT to do this
- How a pro does it differently