Video Lesson: Authentication and Authorisation

“Information security is not a destination, but a continuous journey—both in learning and in practice. And it must not be taken lightly—security can be good or bad. A ‘good enough’ approach does not work, and this has been proven many times. Security breaches, stolen identities, lost data, and fraud appearing in the news are just the tip of the iceberg.”

Source: Security Without Obscurity by Jeff Stapleton

Transcript

Authentication is the process of verifying a user's identity, typically through a password, biometrics, or multi-factor verification, while authorisation follows authentication and determines which resources or data the user is allowed to access. Together, these processes form the foundation of secure system access and the protection of digital identities.

Security is the process of maintaining an acceptable level of risk, representing an ongoing effort to manage and reduce risks to a point deemed acceptable for an organisation, community, or individual. This means that security is not a state that can be fully achieved, but rather a process in which threats and vulnerabilities are continuously assessed, controlled, and mitigated to minimise potential damage. The acceptable level of risk varies depending on the context, resources, and needs, with the aim of ensuring that risks are under control and do not exceed a threshold that could compromise the security of systems, data, or people.

Authentication is the process of verifying the identity of a user or system to ensure access to protected resources. This is typically achieved using one or more credentials, such as a username and password, biometric data (e.g., fingerprints or facial recognition), smart devices, or multi-factor authentication (a combination of something the user knows, has, or is). Authentication enables the system to confirm that the person or device is who they claim to be and ensures that only authorized users have access to sensitive data or functions.

One of the most common methods of authentication is the password. Users enter a secret combination of letters, numbers, and symbols to prove their identity. Although simple, this method is vulnerable to threats such as password theft or brute-force attacks, which is why it is often combined with another authentication method (2FA). This means an additional authentication factor is used, such as a code sent via SMS or generated by an app on a smartphone. A PIN (personal identification number) is also a common authentication method, but it is usually shorter and less secure than a password.

Methods based on something you possess provide a higher level of security. For example, smart cards or tokens generate unique codes that are used for authentication. These devices can be physically portable, meaning the user must have the physical device to access the system. Smartphones can also serve as authentication devices through apps like Google or Microsoft Authenticator, where dynamic codes are generated, or biometric data is used for added security.

One of the most secure forms of authentication is biometric authentication, which uses unique physical traits of the user. Facial recognition, fingerprints, or eye scanners enable authentication that is nearly impossible to forge, as biometric data varies from person to person. This method provides a high level of security because it requires the physical presence of the user, and the process is typically fast and straightforward.

To further enhance security, many organizations use multi-factor authentication (MFA). MFA combines two or more authentication methods, such as password and biometrics, or a password and a code generated via smartphone. This multi-layered approach reduces the risk of unauthorized access because attackers need access to multiple authentication factors to successfully bypass the system.

The process involves several key stages. First, the user must "process" the biometric data, meaning that data such as fingerprints or facial images are captured using specialized devices like fingerprint scanners or high-resolution cameras. This data is then digitized and stored in the system as a biometric template. After storage, during each subsequent authentication, the system compares the user's current biometric data with the data on file in the database. If it matches, the user is identified and granted access to protected resources.

This process provides a very high level of security because biometric traits are unique to each individual, remain consistent over time, and are difficult to replicate or steal, making this type of authentication a reliable way to protect data and systems.

Additionally, biometric data can be stored on the user's device (locally) or on a server (in the cloud), depending on the system type and security settings. This form of authentication also reduces the risk of password theft, as biometric data is not as easily transferable as passwords and PINs. While biometrics are considered secure, it is important to take measures to protect stored biometric data to prevent unauthorized use.

Authorization is the process that allows a user or entity to access specific resources, services, or information within a system after successful authentication. While authentication confirms the identity of the user, authorization determines which actions or privileges the user is permitted to perform in the system. This includes granting access to specific data, applications, or features based on roles, permissions, or security policies established within the system. Authorization can be set in various ways, including access levels (e.g., administrator, user, guest) or specific permissions for accessing files or resources.

Single Sign-On (SSO) is a security technology that allows users to authenticate once and gain access to multiple applications and systems without the need to re-enter their credentials. This system simplifies the authentication process and improves the user experience by enabling access to multiple resources through a single set of user credentials, eliminating the need for multiple passwords and logins across different platforms.

One of the key goals of SSO is to enhance user productivity and reduce the burden on IT departments. By using SSO, organizations can centralize user access management, which increases security, as all authentications are processed at a single point. Additionally, SSO reduces the risk of using weak or reused passwords, since users only need to remember one password.

Authentication and authorization, including the use of biometrics, are critical to cybersecurity as they ensure that only authorized and uniquely identified individuals have access to sensitive data and systems.