Authentication, Passwords and Access Control
Authentication verifies a claimed identity; authorization determines permitted resources and operations. A successful login does not grant unrestricted access.
Summary
Authentication verifies a claimed identity; authorization determines permitted resources and operations. A successful login does not grant unrestricted access. Least privilege limits permissions to those needed for assigned tasks, with server-side checks enforced on every request.
Authentication factors include knowledge, possession, and inherence. Multifactor authentication requires distinct factor categories. Properly implemented WebAuthn security keys provide phishing-resistant authentication.
Password policies should favor long, unique passwords and reject common or compromised choices. Password managers reduce reuse and exposure to credential stuffing. Store password verifiers using a unique, nonsecret salt and a deliberately costly password-hashing function such as Argon2id. Salts prevent identical passwords from producing identical stored hashes. Rate limiting slows online guessing, while costly hashing slows offline guessing after a verifier database breach.
| Access model | Basis for permissions |
|---|---|
| Role-based access control | Permissions assigned to roles that users receive through membership |
| Attribute-based access control | Policies evaluate subject, resource, action, and environmental attributes |
| Discretionary access control | Resource owners control permissions within system policy |
| Mandatory access control | Central policy uses security labels and clearances |
Timely access revocation and audit logs help reduce unauthorized access and support investigation.
Common Misconceptions: Authentication does not replace authorization. A password and a PIN are not distinct authentication factors. Password verifiers should not be stored as plaintext or reversible encryption.
🧠 Key Concepts
- Authentication versus authorization
- Authentication factors
- Multifactor authentication
- Least privilege
- Salted password hashing
- Role-based access control
- Attribute-based access control
- Discretionary access control
- Mandatory access control
- Guessing defenses
🧠 Quick Check
See what you remember from the summary.
Which best describes the distinction between authentication and authorization?
🧠 Flashcards Preview
Tap a card to reveal the definition.
Ready to quiz yourself?
Test what you remember with a full practice quiz on this note. Create a free account and start in seconds.
Full Notes
Read the original note content before deciding whether to save or study from it.
Authentication, Passwords and Access Control
📘 Overview Authentication verifies a claimed identity; authorization determines which resources and operations that identity may access. Secure systems combine strong credential protection with access policies enforced on every request.
🧠 Key Idea A valid login does not imply unrestricted access. Authentication establishes identity, while least-privilege authorization limits that identity to the permissions required for its tasks.
⚔️ Core Details: - Authentication factors fall into knowledge, possession, and inherence categories, such as passwords, security keys, and fingerprints. - Multifactor authentication requires distinct factor categories; a password plus a PIN is not MFA. - Password policies should favor long, unique passwords and reject common or compromised choices. - Password verifiers should use a unique salt and a deliberately costly password-hashing function, such as Argon2id, rather than plaintext or reversible encryption. - Role-based access control assigns permissions to roles that users receive through role membership. - Attribute-based access control evaluates policy using subject, resource, action, and environmental attributes.
🎯 Why It Matters: - Password managers reduce password reuse, limiting the damage from credential stuffing with credentials stolen from another service. - Phishing-resistant authentication, such as properly implemented WebAuthn security keys, reduces reliance on passwords vulnerable to deceptive login pages. - Rate limiting slows online guessing; costly password hashing slows offline guessing after a verifier database breach. - Server-side permission checks, timely access revocation, and audit logs reduce unauthorized access and support investigation.
🧠 Quick Recall: - Authentication versus authorization - Verification of a claimed identity versus determination of permitted actions. - Least privilege - Grant only the permissions necessary for an identity's assigned tasks. - Salt - A unique, nonsecret value included in password hashing to prevent identical passwords from producing identical stored hashes. - Discretionary access control (DAC) - Resource owners control access permissions within system policy. - Mandatory access control (MAC) - Centrally enforced policy governs access using security labels and clearances.
More ways to study when you copy this note
Copy this note into your library to unlock focused practice sessions and long-term review.
Answer all questions first, then see feedback at the end — the way real exams work.
Focuses each session on what you got wrong, not what you already know.
Full timed exam with all questions, no pausing, and results at the end. Built for board exam prep.
Part of 🗄️ BS Information Systems — 1st Year
Browse this Review Set →More Computer Science notes
See all →More in Information Assurance and Security
See all →More from NoteLib
Browse NoteLib's public notes →Copy this note to your library and get the full Study Pack instantly — summary, key concepts, and practice quiz included.