Authentication asks “who are you?” and authorization asks “what are you allowed to do?” Confusing the two is one of the most common mistakes in security.

Authentication factors

Proof of identity comes from categories called factors:

  • Something you know: password, PIN, security answer.
  • Something you have: phone authenticator app, hardware key, smart card.
  • Something you are: fingerprint, face scan.
  • Sometimes somewhere you are or something you do (location, typing rhythm) as extra signals.

Multi-factor authentication (MFA) combines factors from different categories. A password plus a code from an app is MFA; two passwords is not. MFA blunts stolen-password attacks and credential stuffing, where leaked passwords from one site are tried on others.

Good password practice: long passphrases, a password manager, unique passwords per site, and never storing passwords in plain text. Servers should store only salted, slow hashes.

Authorization models

Once identity is confirmed, the system decides permissions. Common models:

  • Discretionary access control (DAC): the owner decides who gets access, like sharing a document. Flexible but easy to misconfigure.
  • Mandatory access control (MAC): a central policy using labels (for example Confidential, Secret) decides, and users cannot override it. Used in government and high-security systems.
  • Role-based access control (RBAC): permissions attach to roles such as Teacher or Admin, and users are assigned roles. Easy to manage at scale.
  • Attribute-based access control (ABAC): rules use attributes like department, time of day or device health.

The guiding rule is least privilege: grant the minimum access for the job, and review it regularly.

Related ideas

  • Accounting (auditing): log who did what, completing the AAA trio of authentication, authorization and accounting.
  • Single sign-on (SSO): log in once to reach many services, reducing password fatigue.
  • Session management: tokens and cookies keep you logged in, so they must expire and be protected.

On a practice Linux VM you own, view permissions and groups to see DAC in action:

id
ls -l /etc/shadow

Check your understanding

1. Which is an example of authorization?

  • Typing your password
  • Scanning a fingerprint
  • A system deciding you may read a folder but not edit it
  • Entering a texted code

Answer: A system deciding you may read a folder but not edit it. Authorization governs permitted actions after identity is known.

2. Which pair counts as true multi-factor authentication?

  • Password and security question
  • Password and authenticator app code
  • Two different passwords
  • PIN and password

Answer: Password and authenticator app code. They come from different factor categories (know and have).

3. In which model do permissions attach to job functions like Teacher or Admin?

  • DAC
  • MAC
  • RBAC
  • None

Answer: RBAC. Users receive roles, and roles carry the permissions.

4. What does least privilege mean?

  • Everyone gets admin rights
  • Users get only the access required for their work
  • Passwords must be short
  • Logs are disabled

Answer: Users get only the access required for their work. This limits damage if an account is compromised.

PreviousNext