Lion Cipher Lab
Turn an identity export into MFA coverage metrics and brief the board (with a scoring rubric)
- Identity & Access Management
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Every board hears "we have MFA" (multi-factor authentication: a second proof of identity on top of the password). The number that usually goes on the slide is the share of all users who registered any second factor, and it is often in the 90s. Attackers do not care about the average user. They want the handful of administrator accounts that can change everything, and they phish the weakest method those admins have. In this lab you will prove, from an export, that a true 95.9% headline sits next to 12 of 23 administrators who have only a text-message code or nothing at all, and 9 accounts…
What you'll learn
- Reading a users-plus-authentication-methods export (the kind Entra ID and Okta produce) and knowing what each column can and cannot prove
- Computing identity-risk metrics in Python: MFA coverage overall vs among privileged accounts, phishing-resistant coverage among admins, standing top-level admins, guests and service accounts holding admin roles
- Spotting the 'headline number lies' effect: a 95.9% MFA figure hiding 12 of 23 admins on SMS or nothing
- Choosing an honest denominator and recognizing how the choice can be used to game a metric
- Writing a one-page board brief: one decision, three numbers, business impact, cost and timeframe, and stated limits
- Scoring a draft against a rubric, revising, and re-scoring, and knowing why a perfect rubric score is necessary but not sufficient
Steps in this lab
- What you are building, and every term you need
- What this lab is NOT (and where those labs live)
- Open a terminal and make a working folder
- Generate the identity export
- Compute the headline, then the number underneath it
- Count the standing admins, and who holds them
- The denominator game: same data, three headlines
- Cross-check with pandas, and the fair view of break-glass
- The honest negatives: what this export cannot prove
- Meet the rubric, and a brief that fails it
- Write a first draft, score it, revise, score again
- Game your own rubric: why 10 out of 10 is not the finish line
- What a pro does next, and cleaning up