Identity, Authentication, and Access Control
Identity is the new perimeter
Core principle
Modern security assumes users, devices, and services may operate outside a trusted network. As a result, identity and access decisions must be made continuously, not just at login.
Authentication factors
| Factor type | Example |
|---|---|
| Something you know | Password or PIN |
| Something you have | Security key or phone token |
| Something you are | Fingerprint or face recognition |
Access control models
Best practice
Multi-factor authentication greatly reduces the value of stolen passwords, especially for remote access and administrative accounts.
Authentication vs authorization
Authentication
- Confirms who or what is requesting access
- Examples include passwords and security keys
Authorization
- Determines what the authenticated identity can do
- Examples include read, write, and admin permissions
Which example is authentication?
Authentication proves identity; a security key is a factor used in that proof.
Correct answer: Verifying a login with a security key
What is RBAC?
RBAC assigns permissions based on job roles rather than individual ad hoc decisions.
Correct answer: Role-based access control
Why is MFA especially valuable for remote logins?
MFA adds a second barrier even if credentials are compromised.
Correct answer: It helps stop account takeover when passwords are stolen
Name one advantage of ABAC over simple RBAC.
ABAC is more flexible because it evaluates policy conditions dynamically.
Correct answer: It can make decisions using contextual attributes such as location, device state, or time