Lesson 3: Identity, Authentication, Authorization, and Access Control

Security starts by answering a simple question: Who is using the system, and what are they allowed to do?

A user's digital identity may be represented by a username, employee number, email account, certificate, token, or other credential. Security systems then apply the AAA model:

• Authentication — proving identity
• Authorization — determining permissions after identity is proven
• Accounting — recording actions for auditing and review

Example:

• A student logs into the university portal using a username and password.
• The portal verifies the student's identity — authentication.
• The student can view subjects but cannot edit grades — authorization.
• The system stores login history and activity logs — accounting.

Many exam questions ask students to separate these three clearly. The easiest way is:

Authentication asks who you are. Authorization asks what you can do. Accounting records what you did.

Authentication factors are usually grouped into categories:

• Something you know — password, PIN, security answer
• Something you have — token, phone, smart card, OTP app
• Something you are — fingerprint, face, iris, voice
• Somewhere you are — location-based checks
• Something you do — behavioral patterns such as typing rhythm

Using more than one factor gives multi-factor authentication or MFA. For example, password + OTP is stronger than password alone.

Good authentication design also considers:

• password length and complexity,
• account lockout or throttling,
• credential storage,
• reset procedures,
• session timeout,
• protection against phishing.

A weak reset process can ruin a strong login system. If an attacker can easily reset a password through social engineering, the system remains vulnerable.