Authentication and Access Control

Authentication and access control are fundamental to keeping computer systems secure. Authentication verifies who you are; access control determines what you are allowed to do. This lesson covers the three factors of authentication, biometrics, two-factor authentication and access control principles.

---

What Is Authentication?

Authentication is the process of verifying that a user or device is who they claim to be. Without authentication, anyone could access any system, and there would be no way to track who did what.

Authentication is based on one or more of three factors:

Factor	Description	Examples
Something you know	Information only the user should know	Password, PIN, security question answer
Something you have	A physical object the user possesses	Smartphone (authenticator app), smart card, USB security key
Something you are	A biological characteristic unique to the user	Fingerprint, iris scan, facial recognition, voice pattern

---

Passwords

Passwords are the most common form of authentication — "something you know". However, passwords have well-known weaknesses:

• Users choose weak passwords ("password123", "qwerty")
• Users reuse passwords across multiple sites
• Passwords can be stolen through phishing, keyloggers or data breaches
• Passwords can be guessed using brute force or dictionary attacks

Strong Password Guidelines

Guideline	Why It Helps
At least 8-12 characters (longer is better)	Exponentially increases brute force time
Mix of uppercase, lowercase, numbers and symbols	Increases the character set the attacker must try
Avoid dictionary words and personal information	Defeats dictionary attacks
Use a different password for every account	Limits damage if one password is compromised
Consider using a password manager	Generates and stores strong, unique passwords

---

Biometric Authentication

Biometrics use unique physical or behavioural characteristics to verify identity — "something you are".

Common Types of Biometric Authentication

Type	How It Works
Fingerprint	Scans the unique ridge patterns on a finger
Facial recognition	Maps the geometry of the face (distance between eyes, nose shape, etc.)
Iris recognition	Scans the unique pattern in the coloured part of the eye
Retina scan	Scans the blood vessel pattern at the back of the eye
Voice recognition	Analyses the unique characteristics of the user's voice

Advantages of Biometrics

• Convenient — no passwords to remember or tokens to carry
• Difficult to forge — fingerprints and iris patterns are unique
• Cannot be forgotten — unlike passwords
• Fast — authentication takes seconds

Disadvantages of Biometrics

• Cannot be changed — if biometric data is compromised (e.g. stolen fingerprint template), you cannot get a new fingerprint
• False positives — an unauthorised person is incorrectly granted access (a security risk)
• False negatives — an authorised person is incorrectly denied access (an inconvenience)
• Privacy concerns — storing biometric data raises ethical questions about surveillance
• Cost — biometric hardware (scanners, cameras) can be expensive
• Environmental factors — dirty fingers, poor lighting or illness can affect accuracy

Exam Tip: If asked to evaluate biometric authentication, always mention the issue of irreversibility. Passwords can be changed if compromised, but you cannot change your fingerprint.

---

Two-Factor Authentication (2FA)

Two-factor authentication requires two different types of authentication factor. Using two factors from the same category (e.g. two passwords) does NOT count as 2FA.

Valid 2FA Combinations

Factor 1	Factor 2	Valid 2FA?
Password (know)	SMS code (have — phone)	Yes
Password (know)	Fingerprint (are)	Yes
Password (know)	Security question (know)	No — both are "something you know"
Fingerprint (are)	Smart card (have)	Yes
Face scan (are)	Iris scan (are)	No — both are "something you are"

Common 2FA Methods

• SMS codes — a one-time code sent to the user's phone via text message
• Authenticator apps — apps like Google Authenticator generate time-based one-time passwords (TOTP)
• Hardware security keys — physical devices (e.g. YubiKey) that plug into a USB port
• Biometric + password — e.g. fingerprint scan after entering a password

Advantages of 2FA

• Significantly more secure — even if a password is stolen, the attacker needs the second factor
• Protects against phishing — a stolen password alone is not enough
• Widely available — most major services now support 2FA

Disadvantages of 2FA

• Inconvenience — adds an extra step to every login
• SIM swapping — attackers can convince a mobile provider to transfer the victim's phone number to a new SIM, intercepting SMS codes
• Device dependency — if the user loses their phone or security key, they may be locked out
• Not all methods are equal — SMS-based 2FA is less secure than authenticator apps or hardware keys

---

Access Control

Once a user is authenticated, access control determines what they are allowed to do within the system.

The Principle of Least Privilege

The principle of least privilege states that every user should have the minimum level of access needed to perform their job — and no more.

Example: A data entry clerk in a hospital should be able to view and update patient records but should NOT be able to delete records, change system settings or access financial data.

Why Least Privilege Matters

• Limits damage — if an account is compromised, the attacker can only access what that user could access
• Reduces insider threat — employees cannot access data outside their role
• Supports accountability — clear records of who accessed what

Access Control Methods

Method	Description
User accounts	Each user has a unique account with defined permissions
User groups	Users are organised into groups (e.g. "Teachers", "Students", "Admin"), and permissions are assigned to the group
File permissions	Read, write, execute permissions on individual files and folders
Network segmentation	Dividing a network into segments so that users can only access the resources in their segment

---

CAPTCHA

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is used alongside authentication to prevent automated bots from:

• Performing brute force login attacks
• Creating fake accounts
• Submitting spam forms

CAPTCHAs work by presenting a challenge that is easy for humans but difficult for computers (e.g. identifying traffic lights in images, solving a simple puzzle).

---

Key Terms Summary