Skip to content

Chapter 2 of 8

Identity, Authentication, and Access Control

Controlling who can do what rests on the AAA framework: authentication, authorization, and accounting. Authentication verifies a user's identity, typically with credentials, tokens, or biometrics. Authorization determines what an authenticated user is allowed to do. Accounting, or audit logging, records who did what and when, supporting investigation and compliance. Identification claims an identity ("I am Alice") while authentication proves it. Strong authentication is critical because accounts are the gateway to nearly every other control, and a single weak password can unravel an entire security posture.

Multi-factor authentication (MFA) raises the bar by requiring two or more independent verification factors drawn from different categories: something you know, such as a password; something you have, such as a phone or hardware token; and something you are, such as biometrics. Even if one factor is compromised, an attacker still cannot access the account without the others. Two-factor authentication (2FA) is the specific case of MFA using exactly two factors. Modern passwordless standards build on public-key cryptography: passkeys are device-bound, phishing-resistant credentials with no shared secret; WebAuthn is the W3C standard that underpins them; and FIDO2 combines WebAuthn with CTAP. Time-based one-time passwords (TOTP, RFC 6238) generate 6-digit codes from authenticator apps, while counter-based HOTP is less common. Federated identity and single sign-on (SSO) extend this further: SAML is an XML-based SSO standard, OAuth 2.0 is an authorization framework that lets apps obtain limited access without sharing passwords, and OpenID Connect is an identity layer on top of OAuth 2.0 that adds authentication and ID tokens. JSON Web Tokens (JWT) are a compact, URL-safe token format with a Header.Payload.Signature structure of three base64url-encoded parts used throughout these systems.

Once identity is established, access models determine permissions. Role-Based Access Control (RBAC) assigns permissions to roles and assigns users to those roles, simplifying administration. Attribute-Based Access Control (ABAC) makes decisions based on attributes of the user, resource, action, and environment, allowing fine-grained, context-aware policy enforcement. Strong passwords are long, unique, and unpredictable; length matters more than complexity because each additional character exponentially increases the number of combinations an attacker must try. Users should never reuse passwords because a single breached site enables credential stuffing, where stolen username/password combinations are automatically tried on thousands of other services. A password manager generates and stores unique strong passwords for every account, encrypted behind one master password, eliminating reuse and the need to memorize complex strings. Sessions represent server-side state for a logged-in user, referenced by a session ID in a cookie; defenses against session fixation (rotate the session ID on login) and session hijacking (protect the session ID with the Secure and HttpOnly attributes) round out identity hygiene.

All chapters
  1. 1Foundations of Cybersecurity
  2. 2Identity, Authentication, and Access Control
  3. 3Cryptography and Public Key Infrastructure
  4. 4Network and Infrastructure Security
  5. 5Application and Web Security
  6. 6Threats, Attacks, and Malware
  7. 7Defense Operations and Incident Response
  8. 8Governance, Risk, and Compliance

Drill it

Reading is not remembering. These come from the Cybersecurity Fundamentals deck:

Q

What are the three components of the CIA triad in cybersecurity?

Confidentiality (ensuring data is accessible only to authorized parties), Integrity (ensuring data is accurate and unaltered), and Availability (ensuring system...

Q

How does a breach of "integrity" in the CIA triad differ from a breach of "confidentiality"?

A confidentiality breach means unauthorized parties accessed the data (e.g., a data leak). An integrity breach means the data was altered or tampered with witho...

Q

Why is "availability" considered equally important as confidentiality and integrity?

Even if data remains confidential and unaltered, a system is useless if legitimate users cannot access it when needed. DDoS attacks, ransomware, and hardware fa...

Q

What is a phishing attack and what makes spear phishing more dangerous?

Phishing uses fraudulent emails or messages to trick victims into revealing sensitive information or clicking malicious links. Spear phishing targets a specific...