Tutorial 3.1: Introduction to Authentication and Access Control

← Previous Tutorial | Table of Contents | Unit Home | Next Tutorial →

Table of Contents

Learning Objectives

After completing this tutorial, you should be able to:

Overview

Authentication and access control form the bedrock of modern computer and network security. Every time a user logs into a system, accesses a file, or initiates a network transaction, a series of security decisions must be made: Who is this entity? Is this entity who they claim to be? What resources should this entity be allowed to access? These questions lie at the heart of identity and access management (IAM), and their answers determine whether a system remains secure or falls prey to unauthorized access, data breaches, and insider threats.

In this first tutorial of Unit 3, we establish the conceptual foundation for the entire series. We begin by introducing the IAAA framework—Identification, Authentication, Authorization, and Accounting—which provides a structured way to think about security enforcement. We then examine the core security principles that guide the design of secure authentication and access control systems, including least privilege, separation of duties, defense in depth, and the need-to-know principle. These principles are not abstract ideals; they are practical tools that security architects use daily to reduce risk and limit the impact of security incidents.

We then turn to authentication itself, exploring the three primary factors: something you know (e.g., passwords), something you have (e.g., hardware tokens), and something you are (e.g., biometrics). We discuss the strengths and limitations of each factor and introduce the concept of multi-factor authentication (MFA) as a means of achieving stronger assurance. The section on access control introduces the fundamental elements—subjects, objects, permissions, and policies—and outlines the main access control models that will be explored in greater depth in later tutorials.

The tutorial also addresses the critical relationship between authentication and access control: authentication establishes who an entity is, while access control determines what that entity can do. Together, they form a continuum that underpins secure system operation. We conclude with a discussion of common threats—from credential theft to insider abuse—and the countermeasures that organizations can deploy to mitigate these risks. The tutorial closes with a case study that illustrates how these concepts play out in a real-world enterprise environment.

This tutorial serves as the gateway to Unit 3. The concepts introduced here will be developed and deepened in subsequent tutorials, where we explore specific authentication mechanisms (Tutorials 3.3–3.6), advanced protocols such as Kerberos (Tutorial 3.7), directory services (Tutorial 3.8), and the full spectrum of access control models (Tutorials 3.9–3.13). By the end of this tutorial, you will have a solid conceptual framework that will allow you to understand and evaluate the more detailed technical material that follows.

1. The IAAA Framework: Identification, Authentication, Authorization, and Accounting

1.1 Identification

Identification is the act of claiming an identity. In a digital system, this typically takes the form of a username, user ID, email address, or other unique identifier. Identification alone does not provide any assurance that the entity presenting the identifier is actually the legitimate owner of that identity. It is merely a claim. For example, when you type jdoe into a login prompt, you are identifying yourself as jdoe—but the system has no way of knowing whether you are actually John Doe or an impostor.

Identification is a necessary first step in any secure interaction, but it is insufficient on its own. Without subsequent verification, identification is merely a statement of intent, not proof of identity.

1.2 Authentication

Authentication is the process of verifying the identity claim made during identification. It answers the question: Is this entity truly who they claim to be? Authentication relies on one or more authentication factors—pieces of evidence that the entity presents to prove their identity. These factors fall into three broad categories (discussed in detail in Section 3): something you know, something you have, and something you are.

Authentication is the cornerstone of security because it establishes trust in the identity of users, devices, and services. Without reliable authentication, all subsequent security decisions—authorization, access control, and auditing—are built on a shaky foundation.

1.3 Authorization

Authorization determines what an authenticated entity is permitted to do within the system. It answers the question: What resources and operations can this entity access? Authorization is typically enforced through access control mechanisms that map identities (or their attributes) to permissions, rights, and privileges.

Crucially, authorization depends on authentication. You cannot meaningfully authorize an entity until you have established its identity with sufficient confidence. However, authentication and authorization are distinct functions: authentication establishes who you are; authorization establishes what you can do.

1.4 Accounting (Auditing)

Accounting (also called auditing) is the process of recording and monitoring the activities of authenticated and authorized entities. It answers the question: What did this entity do while they were on the system? Accounting provides the data needed for security monitoring, incident investigation, compliance reporting, and usage billing.

The IAAA framework is sometimes referred to as AAA (Authentication, Authorization, and Accounting) with identification considered a prerequisite step. Regardless of terminology, the core idea is that secure system operation requires all four functions working in concert.

Key Takeaway: The IAAA framework provides a structured approach to security enforcement. Identification establishes a claimed identity; authentication verifies that claim; authorization grants permissions; and accounting tracks activities. Each function depends on the others, and weaknesses in any one component can compromise the entire security posture.

1.5 The Identity Lifecycle

Digital identities are not static. They are created, modified, and eventually decommissioned over time. The identity lifecycle encompasses the full span of an identity's existence within an organization:

Effective identity lifecycle management is critical for security. Orphaned accounts, stale permissions, and inadequate de-provisioning processes are among the most common causes of security incidents. We will revisit identity lifecycle management in Tutorial 3.8 (Directory Services and Identity Management).

2. Core Security Principles

Before diving into the mechanics of authentication and access control, it is essential to understand the foundational security principles that guide their design and implementation. These principles, drawn from decades of security engineering and risk management, provide the normative framework for building secure systems.

2.1 Least Privilege

The principle of least privilege states that every entity (user, process, service, device) should be granted only the minimum privileges necessary to perform its assigned functions. This principle limits the potential damage that can result from errors, compromised accounts, or malicious actions. For example, a database administrator should not have the ability to modify the operating system's security configuration unless that capability is absolutely required for their job.

In practice, least privilege is enforced through careful permission assignments, role-based access control, and regular privilege reviews. It is a cornerstone of Zero Trust architectures and is widely recognized as a best practice in enterprise security.

2.2 Separation of Duties

The separation of duties (also known as segregation of duties) ensures that no single individual has complete control over a critical process or function. By dividing responsibilities among multiple people, the risk of fraud, error, and abuse is reduced. For example, in financial systems, the person who initiates a payment should not be the same person who approves it.

In access control terms, separation of duties is often implemented through conflict-of-interest rules that prevent a user from being assigned to mutually incompatible roles. This is a key feature of role-based access control (RBAC), which we will examine in Tutorial 3.12.

2.3 Defense in Depth

Defense in depth is the strategy of deploying multiple layers of security controls so that the failure of any single control does not compromise the entire system. In the context of authentication and access control, defense in depth might involve:

Defense in depth acknowledges that no single security measure is perfect and that a resilient system must be able to withstand the failure or compromise of individual components.

2.4 Need-to-Know

The need-to-know principle is closely related to least privilege. It holds that entities should be granted access only to the information that is necessary for them to perform their tasks. This principle is particularly important in environments handling sensitive or classified data, where even authenticated and authorized users may be restricted to specific subsets of information based on their roles and clearance levels.

Practical Implication: These principles are not abstract ideals—they are operational requirements that must be translated into concrete policies, procedures, and technical controls. Organizations that neglect these principles often find themselves vulnerable to privilege escalation, insider threats, and compliance violations.

3. Authentication Fundamentals

3.1 The Three Authentication Factors

Authentication factors are the categories of evidence that can be used to verify an identity claim. The three classic factors are:

Factor Category Examples Strengths Weaknesses
Type 1 Something You Know Password, PIN, passphrase, security question Easy to implement, low cost, familiar to users Vulnerable to guessing, theft, phishing, shoulder-surfing
Type 2 Something You Have Hardware token, smart card, mobile device, OTP generator Not easily guessed, can be used in MFA Can be lost, stolen, cloned; requires physical possession
Type 3 Something You Are Fingerprint, facial recognition, iris scan, voiceprint Hard to forge, convenient, non-repudiation potential Privacy concerns, accuracy issues, can be spoofed (with difficulty)

Two additional factors are sometimes recognized:

However, these are typically considered subtypes or extensions of the three primary factors rather than independent categories.

3.2 Single-Factor vs. Multi-Factor Authentication

Single-factor authentication (SFA) relies on only one authentication factor. Passwords are the most common example. SFA is convenient and inexpensive, but it is inherently vulnerable because a single point of failure (the factor) can compromise the entire authentication process.

Multi-factor authentication (MFA) requires two or more authentication factors from different categories. For example, a system might require a password (Type 1) and a one-time code generated by a mobile app (Type 2). MFA significantly increases the difficulty of unauthorized access because an attacker would need to compromise multiple independent factors. MFA is now considered a baseline security requirement for most enterprise and consumer systems.

3.3 Authentication Assurance Levels

Not all authentication methods provide the same level of confidence. The NIST Digital Identity Guidelines (SP 800-63B) define three assurance levels for authentication:

The choice of assurance level should be informed by a risk assessment: higher-value assets and higher-risk transactions require higher assurance levels.

Key Takeaway: Authentication is the process of verifying identity claims. The three factors—knowledge, possession, and inherence—offer different trade-offs between security and convenience. Multi-factor authentication is essential for achieving meaningful security, and the appropriate assurance level depends on the risk profile of the system.

4. Access Control Fundamentals

4.1 Core Concepts: Subjects, Objects, and Permissions

Access control is built on three fundamental entities:

An access control policy defines the rules that govern which subjects can access which objects and with which permissions. The policy is the authoritative statement of security requirements, and it is enforced by the access control mechanism.

4.2 Access Control Models: A First Look

Access control models provide a formal framework for defining and enforcing access control policies. The major models that we will explore in detail in later tutorials are:

Each model has strengths and weaknesses, and the choice of model depends on the security requirements, organizational structure, and operational context.

4.3 Access Control Mechanisms

Access control policies are enforced by mechanisms such as:

Note: The separation of policy decision and policy enforcement is a key architectural pattern in modern access control systems, particularly in distributed and cloud environments. We will revisit this in Tutorial 3.16.

5. The Authentication–Access Control Continuum

Authentication and access control are often discussed as separate topics, but in practice, they form a continuum of security enforcement. Figure 1 illustrates the relationship:

┌─────────────────────────────────────────────────────────────────────────────┐ │ SECURITY ENFORCEMENT CONTINUUM │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ IDENTIFICATION ──► AUTHENTICATION ──► AUTHORIZATION ──► ACCESS │ │ (claim identity) (verify claim) (determine permissions) (grant/deny) │ │ │ │ ◄─────────────────────── CONTINUOUS MONITORING ──────────────────────► │ │ │ └─────────────────────────────────────────────────────────────────────────────┘

The continuum starts with identification, proceeds through authentication and authorization, and results in an access decision. However, security is not a one-time event. Modern systems employ continuous authentication and adaptive access control that re-evaluate access decisions throughout a session based on changes in risk, behavior, or context.

This continuum also underscores the importance of integration: a system with strong authentication but weak authorization is vulnerable, and vice versa. Security architects must design authentication and access control as a unified system.

6. Threats and Countermeasures

6.1 Authentication Threats

Threat Description Countermeasures
Credential Theft Attackers steal passwords, tokens, or biometric data. MFA, encrypted storage, hardware security modules (HSMs), behavioral monitoring.
Password Guessing Attackers use dictionary, brute-force, or credential-stuffing attacks. Strong password policies, rate limiting, account lockout, CAPTCHA, MFA.
Phishing Attackers trick users into revealing credentials. User education, anti-phishing controls, MFA, FIDO2/WebAuthn.
Man-in-the-Middle Attackers intercept and potentially modify authentication traffic. Mutual TLS, certificate pinning, secure protocols (SSH, HTTPS).
Session Hijacking Attackers steal session tokens after authentication. Short-lived tokens, token binding, secure cookies, HTTPS.
Replay Attacks Attackers re-transmit captured authentication messages. Nonces, timestamps, session keys, challenge-response protocols.

6.2 Access Control Threats

Threat Description Countermeasures
Privilege Escalation Attackers gain higher privileges than authorized. Least privilege, separation of duties, regular privilege reviews.
Insider Abuse Authorized users misuse their privileges. Monitoring, auditing, behavioral analytics, just-in-time privileges.
Policy Misconfiguration Incorrectly configured access controls expose resources. Automated policy validation, infrastructure-as-code, regular audits.
Insecure Direct Object References Attackers manipulate object identifiers to access unauthorized resources. Access control checks on every request, random/indirect references.

6.3 Foundational Countermeasures

Effective security requires a layered approach. The following countermeasures are foundational for protecting authentication and access control systems:

7. Real-World Applications and Case Studies

7.1 Case Study: Enterprise IAM Implementation

Scenario: A large financial services organization with 15,000 employees and 2 million customers must implement a robust identity and access management system to comply with regulatory requirements (e.g., SOX, GDPR, PCI-DSS) and defend against increasingly sophisticated cyber threats.

Solution Approach:

Outcome: The organization achieved a 75% reduction in identity-related security incidents within 12 months, met all regulatory audit requirements, and significantly improved operational efficiency through automated provisioning and de-provisioning.

7.2 Case Study: Cloud Migration and Identity Federation

Scenario: A mid-sized healthcare provider is migrating its on-premises applications to AWS and Azure. It needs to ensure that its 2,500 employees can access both on-premises and cloud resources using the same credentials, while maintaining compliance with HIPAA and other healthcare regulations.

Solution Approach:

Outcome: The provider achieved a seamless, secure hybrid cloud environment. User satisfaction improved (single sign-on), security improved (conditional access, MFA), and compliance was maintained.

7.3 Key Lessons from the Case Studies

8. Summary and Transition

In this tutorial, we established the conceptual foundation for the entire Unit 3 series. We introduced the IAAA framework (Identification, Authentication, Authorization, and Accounting) as a structured way to understand security enforcement, and we examined the core security principles—least privilege, separation of duties, defense in depth, and need-to-know—that guide the design of secure systems. We explored the three authentication factors and the importance of multi-factor authentication, and we introduced the fundamental elements of access control: subjects, objects, and permissions.

We also discussed the continuum between authentication and access control, emphasizing that they are not separate functions but parts of a unified security enforcement process. Finally, we surveyed the major threats to authentication and access control systems and outlined countermeasures that organizations can deploy to mitigate these risks.

This tutorial sets the stage for the more detailed technical explorations that follow. In Tutorial 3.2, we will dive deeper into the IAAA framework and examine the concepts of digital identity, trust, and assurance in greater depth. Subsequent tutorials will explore specific authentication mechanisms (passwords, MFA, biometrics), authentication protocols (including Kerberos), directory services, and access control models.

As you work through the quiz, exercises, and homework for this tutorial, keep in mind that the concepts introduced here are not just academic—they are the tools that security professionals use every day to protect systems and data.

Quiz

Answer the following questions to check your understanding. Click the "Answer" button to reveal the solution.

Q1. Which of the following correctly orders the steps of the IAAA framework?

Answer
B) Identification → Authentication → Authorization → Accounting. Identification establishes a claimed identity; authentication verifies that claim; authorization grants permissions; and accounting tracks activities.

Q2. A hardware security token that generates a one-time password is an example of which authentication factor?

Answer
B) Something you have. The hardware token is a physical possession that the user must have in their possession to authenticate.

Q3. Which security principle states that no single individual should have complete control over a critical process?

Answer
C) Separation of duties. This principle divides responsibilities among multiple individuals to reduce the risk of fraud or error.

Q4. A system that requires a password, a fingerprint scan, and a one-time code from a mobile app is using:

Answer
C) Three-factor authentication. The system uses one factor from each category: something you know (password), something you are (fingerprint), and something you have (one-time code from a mobile app).

Q5. In access control terminology, a subject is:

Answer
B) An active entity that requests access. Subjects are typically users, processes, or services that initiate access requests to objects.

Q6. What is the primary difference between identification and authentication?

Answer
A) Identification is the claim of identity (e.g., providing a username); authentication is the verification of that claim (e.g., providing a password or other evidence).

Q7. Which NIST Authentication Assurance Level (AAL) typically requires two-factor authentication?

Answer
B) AAL 2 (Moderate). AAL 1 is single-factor, AAL 2 requires two-factor authentication, and AAL 3 requires strong cryptographic or three-factor authentication.

Q8. In an access control system, a capability list is associated with:

Answer
B) A subject. A capability list is attached to a subject and specifies the objects and permissions that the subject is authorized to use.

Q9. Which of the following is not considered a core security principle for authentication and access control?

Answer
D) Maximum privilege. This is the opposite of the principle of least privilege and is not considered a security principle.

Q10. A security system that uses a user's IP address and GPS location as part of the authentication decision is leveraging:

Answer
D) Somewhere you are. Location-based authentication uses the user's physical or network location as a factor, often in conjunction with other factors.

Q11. A "credential-stuffing" attack is a type of attack in which:

Answer
B) An attacker uses usernames and passwords leaked from one site to gain access to other sites. This is why password reuse is dangerous and why MFA is critical.

Q12. Which access control model allows the owner of a resource to decide who can access it and with what permissions?

Answer
B) Discretionary Access Control (DAC). In DAC, the owner of the object has discretion over who can access it and with which permissions.

Exercises

These exercises are designed to help you apply the concepts from this tutorial. Attempt each exercise before revealing the sample solution.

Exercise 3.1-1: IAAA Mapping

For each of the following activities, identify which component of the IAAA framework it represents: Identification, Authentication, Authorization, or Accounting.

  1. A user enters their username into a login form.
  2. A system checks whether a user has the "Administrator" role before allowing them to install software.
  3. A log entry records that user jsmith accessed the /finance/reports directory at 14:23.
  4. A system verifies a user's password against the stored hash.
  5. A user attempts to access a file they own; the system grants read and write access.
Sample Solution
  1. Identification – The username is a claim of identity.
  2. Authorization – The system checks permissions before allowing the operation.
  3. Accounting – The log entry records a user's activity for auditing and monitoring.
  4. Authentication – The system is verifying the identity claim using a password.
  5. Authorization – The system grants permissions based on ownership and policy.

Exercise 3.1-2: Security Principles Analysis

For each of the following security controls, identify which core security principle (or principles) it primarily supports. Justify your answer.

  1. A policy that requires two different managers to approve a financial transaction exceeding $10,000.
  2. A file system permission that grants a user read access to a file but not write access.
  3. An authentication system that requires a password, a hardware token, and a fingerprint scan.
  4. An audit log that records all administrative actions taken on a system.
Sample Solution
  1. Separation of duties – Two managers are required to approve the transaction, ensuring that no single individual has complete control.
  2. Least privilege – The user is granted only read access, not write access, which is the minimum privilege needed for their task (assuming they only need to read).
  3. Defense in depth – Multiple authentication factors create layered security, so that the compromise of one factor does not compromise the entire system.
  4. Accounting – The audit log is a form of accounting that enables accountability, detection, and investigation.

Exercise 3.1-3: Authentication Factor Classification

Classify each of the following authentication mechanisms into one or more of the three primary factors (Knowledge, Possession, Inherence). If a mechanism combines factors, list all that apply.

  1. A 6-digit PIN.
  2. A smart card inserted into a reader.
  3. A voiceprint used for authentication.
  4. A password plus a one-time code sent via SMS.
  5. A FIDO2 security key that uses a fingerprint sensor.
Sample Solution
  1. Knowledge – The PIN is something you know.
  2. Possession – The smart card is something you have.
  3. Inherence – The voiceprint is something you are (a biometric).
  4. Knowledge + Possession – Password (knowledge) plus OTP sent via SMS (possession of the phone).
  5. Possession + Inherence – The FIDO2 key is something you have, and the fingerprint sensor is something you are.

Exercise 3.1-4: Access Control Scenario Analysis

Consider a university library system. Students can borrow books, view their own borrowing history, and search the catalog. Faculty can borrow books for a longer period and can also place reserve requests. Library staff can manage book inventory, view all patron records, and override borrowing rules. The system administrator has full access to the system.

  1. Identify the subjects in this scenario.
  2. Identify the objects in this scenario.
  3. For each subject type, list the permissions they should have based on the description.
  4. Which security principle is being violated if a student can also view faculty borrowing records?
Sample Solution
  1. Subjects: Students, Faculty, Library Staff, System Administrator.
  2. Objects: Books, Borrowing history records, Catalog, Inventory records, Patron records, Borrowing rules.
    • Students: Borrow books, view own history, search catalog.
    • Faculty: Borrow books (longer period), place reserve requests, search catalog, view own history.
    • Library Staff: Manage inventory, view all patron records, override borrowing rules.
    • System Administrator: Full system access.
  4. Least privilege and need-to-know are being violated. A student should not have access to faculty borrowing records because they are not necessary for the student's role.

Exercise 3.1-5: Threat Analysis and Countermeasures

A company has deployed a new web-based application. The application uses password-based authentication only (single factor). Employees have complained that they have to remember too many passwords, and many are writing them on sticky notes. The company has also noticed a recent increase in phishing emails targeting employees.

  1. Identify at least three specific threats to the company's authentication system.
  2. For each threat, propose a specific countermeasure that the company could implement.
  3. Describe how the principle of "defense in depth" could be applied to strengthen the authentication system.
Sample Solution
  1. Threats:
    • Credential theft – Password-based authentication is vulnerable to phishing and credential-stealing malware.
    • Password fatigue – Users writing passwords on sticky notes creates a physical security risk.
    • Brute-force/dictionary attacks – Weak passwords can be guessed or cracked.
  2. Countermeasures:
    • Implement multi-factor authentication (MFA) to add a second factor beyond the password.
    • Deploy a password manager to reduce password fatigue and eliminate the need for sticky notes.
    • Enforce strong password policies (minimum length, complexity) and implement rate limiting and account lockout.
  3. Defense in depth:
    • Combine MFA with risk-based authentication that prompts for step-up authentication on suspicious login attempts.
    • Use behavioral analytics to detect anomalous login patterns (e.g., from unusual locations).
    • Implement real-time threat intelligence to block known malicious IPs and phishing domains.
    • Conduct regular phishing simulations and user awareness training to reduce susceptibility to credential theft.

Homework

These homework questions require deeper analysis, research, and application. Answer each question comprehensively.

Homework 3.1-1: IAAA in Practice

Select an online service that you use regularly (e.g., email, banking, social media, cloud storage). Analyze its authentication and access control mechanisms using the IAAA framework. Write a 500–750 word analysis that:

  1. Describes how the service handles identification (e.g., username/email, user ID).
  2. Explains the authentication methods used (single-factor, MFA, biometric, etc.).
  3. Describes what authorization mechanisms are in place (e.g., roles, permissions, file-level access).
  4. Discusses the accounting/auditing features (e.g., login history, activity logs, notifications).
  5. Identifies at least one security strength and one potential weakness in the service's IAAA implementation.
  6. Proposes one improvement that could enhance the service's security posture.
Sample Answer

Note: The sample answer is illustrative; your answer should reflect your chosen service.

Example: Google Account (Gmail/Google Workspace)

  • Identification: Users identify themselves using an email address or phone number associated with the account.
  • Authentication: Google supports single-factor (password) and multi-factor authentication (password + TOTP, security key, or push notification). Advanced Protection Program users are required to use hardware security keys.
  • Authorization: Google uses a combination of role-based and attribute-based access control. Administrators can assign roles (e.g., User, Admin, Super Admin) and define policies for access to specific services (e.g., Gmail, Drive, Calendar). Users have granular permissions for sharing files and folders.
  • Accounting: Google provides audit logs for administrative actions, login history, and user activity. Users can review their own login sessions and revoke access to devices. Security alerts are sent for suspicious activity.
  • Strength: Google's support for MFA and security keys provides strong authentication assurance.
  • Weakness: Password-based authentication is still the default for many users, and MFA adoption is not always enforced.
  • Improvement: Enforce MFA for all users by default, with exceptions only for low-risk accounts after risk review.

Homework 3.1-2: Designing an Authentication and Access Control Policy

You are the security architect for a medium-sized healthcare organization with 1,000 employees. The organization operates three clinics, a central administrative office, and a cloud-based electronic health record (EHR) system. The organization must comply with HIPAA, which requires strict controls over patient data.

Develop a high-level authentication and access control policy document. Include:

  1. An overview of the security principles that will guide the policy (least privilege, separation of duties, defense in depth, need-to-know).
  2. Authentication requirements: factors, minimum assurance level, MFA requirements, password policy.
  3. Access control strategy: model(s) to be used (e.g., RBAC, ABAC) and how roles/attributes will be defined.
  4. Identity lifecycle management: provisioning, maintenance, and de-provisioning processes.
  5. Monitoring and auditing requirements.
  6. How the policy addresses the specific risks of healthcare data (patient privacy, insider threats, etc.).
Sample Answer

Authentication and Access Control Policy – Healthcare Organization

  • Guiding Principles: Least privilege, separation of duties, defense in depth, need-to-know. All access decisions are based on the principle that access to patient data is granted only on a need-to-know basis for patient care or administrative purposes.
  • Authentication: All users must authenticate using MFA (password + TOTP). Users with administrative access to the EHR must use hardware security keys (FIDO2). NIST AAL 2 is the minimum standard; AAL 3 for privileged accounts. Password policy: minimum 12 characters, complexity required, 90-day expiry with 24-hour warning, and password history of 24 passwords.
  • Access Control: RBAC with ABAC extensions. Roles: Clinician (read/write patient records), Billing (read-only access to billing-related data), Administrator (full access to EHR, but with separation of duties: no single admin can modify patient data without approval). Dynamic attributes: department, shift, patient relationship (primary care provider), and emergency status.
  • Identity Lifecycle: Provisioning: HR triggers account creation on day 1; roles are assigned based on job function. Maintenance: regular access reviews every 90 days. De-provisioning: immediate deactivation upon termination, with a 30-day data retention and transfer process.
  • Monitoring: All access to patient records is logged; alerts are triggered for unusual access patterns (e.g., access outside of work hours, access to records of high-profile patients).
  • Risk Mitigation: Patient data is classified as sensitive and subject to additional controls (e.g., encryption, access approval workflows for sensitive records). Insider threats are addressed through separation of duties and continuous monitoring.

Homework 3.1-3: Comparative Analysis of Authentication Factors

Write a comparative analysis (750–1,000 words) of the three primary authentication factors. Your analysis should:

  1. Describe each factor in detail, including examples of mechanisms that use it.
  2. Analyze the security strengths and weaknesses of each factor.
  3. Evaluate the usability implications of each factor for different user populations (e.g., elderly users, users with disabilities, users in developing regions).
  4. Discuss the cost and complexity of deploying each factor at scale in an enterprise environment.
  5. Provide recommendations for when each factor should be used and how they can be combined effectively in an MFA strategy.
Sample Answer

Comparative Analysis of Authentication Factors

  • Knowledge (Something You Know): Passwords, PINs, passphrases, security questions. Strengths: low cost, easy to implement, familiar. Weaknesses: vulnerable to guessing, phishing, theft, and reuse. Usability: widely accessible, but password fatigue leads to poor practices. Cost: low; but helpdesk costs for resets can be significant. Recommendation: use in combination with other factors; avoid security questions.
  • Possession (Something You Have): Hardware tokens, smart cards, TOTP apps, security keys. Strengths: not easily guessed, provides second factor. Weaknesses: can be lost, stolen, or cloned; requires physical possession. Usability: generally good with mobile apps; hardware tokens may be inconvenient. Cost: moderate to high; hardware tokens have per-unit costs, mobile apps are low-cost. Recommendation: deploy for all users as part of MFA; use FIDO2/WebAuthn for phishing-resistant authentication.
  • Inherence (Something You Are): Fingerprint, facial recognition, iris scan, voiceprint. Strengths: hard to forge, convenient, non-repudiation. Weaknesses: privacy concerns, accuracy issues, can be spoofed (with effort). Usability: excellent for many users, but can be problematic for users with certain disabilities or environmental factors. Cost: moderate to high; requires specialized hardware. Recommendation: use as a convenience factor for mobile devices; not suitable as the sole factor for high-risk applications.

MFA Strategy: A robust MFA strategy combines knowledge (password) with possession (TOTP or security key) as the baseline. Inherence can be added as a third factor for high-risk environments. Organizations should adopt phishing-resistant authentication (e.g., FIDO2) and implement risk-based step-up authentication.

Homework 3.1-4: Threat Modeling for Authentication Systems

Conduct a threat model analysis for an authentication system that uses password-based authentication with MFA via SMS-delivered one-time codes. Your analysis should:

  1. Identify the assets to be protected.
  2. Identify the threat actors and their motivations.
  3. Identify at least six specific threats to the authentication system.
  4. For each threat, identify the potential impact on the system and the organization.
  5. Recommend countermeasures for each threat, prioritizing those with the highest impact.
  6. Discuss the limitations of SMS-based MFA and whether you would recommend it for a high-security environment.
Sample Answer

Threat Model: Password + SMS MFA

  • Assets: User credentials, session tokens, access to protected resources, personal data, financial information, intellectual property.
  • Threat Actors: External attackers (phishers, credential stuffers, SIM-swappers), nation-state actors, insiders.
  • Threats and Countermeasures:
    • Phishing (high impact): Attackers trick users into revealing credentials and OTPs. Countermeasures: user education, anti-phishing controls, use of FIDO2/WebAuthn instead of SMS.
    • SIM swapping (high impact): Attackers convince the mobile carrier to port the victim's phone number. Countermeasures: use hardware tokens or authenticator apps instead of SMS; PIN/passcode with carrier.
    • Man-in-the-Middle (medium impact): Attackers intercept authentication traffic. Countermeasures: use HTTPS/TLS, mutual authentication, certificate pinning.
    • Brute-force/credential stuffing (medium impact): Attackers attempt to guess passwords. Countermeasures: strong password policy, rate limiting, account lockout, CAPTCHA.
    • OTP interception (low-medium impact): Attackers intercept SMS messages via SS7 or malware. Countermeasures: use app-based TOTP instead of SMS, encryption.
    • Insider threat (medium impact): Employees with access to the authentication system. Countermeasures: least privilege, separation of duties, monitoring, audit logging.
  • SMS MFA Limitations: SMS is vulnerable to interception (SS7), SIM swapping, and phishing. NIST SP 800-63B recommends against SMS as a primary authentication method. Recommendation: For high-security environments, use app-based TOTP or, ideally, FIDO2/WebAuthn hardware security keys.

Homework 3.1-5: Zero Trust and Authentication

Research the Zero Trust security model (also known as Zero Trust Architecture or ZTA). Write a 500–750 word analysis that:

  1. Defines the Zero Trust model and its core principles.
  2. Explains how the Zero Trust model changes the traditional approach to authentication and access control.
  3. Discusses the role of continuous authentication, dynamic access control, and micro-segmentation in Zero Trust.
  4. Analyzes the challenges and benefits of implementing Zero Trust in an enterprise environment.
  5. Evaluates whether the organization described in Homework 3.1-2 (healthcare provider) would benefit from a Zero Trust approach, and why.
Sample Answer

Zero Trust and Authentication

  • Definition: Zero Trust is a security model that assumes no user, device, or network is inherently trusted, even if they are inside the organization's network perimeter. Every access request must be authenticated, authorized, and continuously validated.
  • Core Principles: Never trust, always verify; least privilege; assume breach; continuous validation; micro-segmentation.
  • Changes to Authentication and Access Control: Zero Trust moves away from perimeter-based security (trusted internal network, untrusted external network). Instead, every access request is evaluated based on context: user identity, device health, location, time, and risk. Authentication is continuous—not a one-time event. Access decisions are dynamic and adaptive.
  • Role of Micro-segmentation: Network segments are isolated so that even if an attacker compromises one segment, they cannot move laterally.
  • Challenges: Complexity, cost, cultural resistance, and the need for mature identity and asset management. Benefits: significantly reduced attack surface, containment of breaches, and improved compliance.
  • Healthcare Evaluation: Yes, a healthcare organization would benefit significantly from Zero Trust. Patient data is highly sensitive and regulated. Zero Trust would help ensure that even if an internal network is compromised, patient data remains protected through continuous validation and micro-segmentation. It would also support HIPAA compliance by enforcing strict access controls and auditing.

Summary

This tutorial introduced the foundational concepts of authentication and access control, establishing the conceptual framework for the entire Unit 3 series. We began with the IAAA framework—Identification, Authentication, Authorization, and Accounting—which provides a structured way to understand security enforcement. We then examined the core security principles that guide the design of secure systems: least privilege, separation of duties, defense in depth, and need-to-know.

We explored the three primary authentication factors—knowledge, possession, and inherence—and discussed their strengths, weaknesses, and practical applications. We also introduced multi-factor authentication as a means of achieving stronger assurance and discussed the NIST authentication assurance levels (AAL 1–3) as a standard for evaluating authentication strength.

The tutorial then turned to access control, introducing the fundamental entities (subjects, objects, and permissions) and the major access control models—DAC, MAC, RBAC, and ABAC—that will be explored in detail in later tutorials. We emphasized the continuity between authentication and access control, showing how they form an integrated security enforcement process.

We also surveyed common threats to authentication and access control systems—from credential theft and phishing to privilege escalation and insider abuse—and outlined the countermeasures that organizations can deploy to mitigate these risks. The case studies illustrated how these concepts play out in real-world enterprise and cloud environments.

This tutorial has provided you with a solid conceptual foundation. In the next tutorial, Tutorial 3.2, we will deepen our exploration of identity, authentication, and trust, examining digital identity, identity assurance, trust frameworks, and the relationship between authentication and authorization in greater detail.

← Previous Tutorial | Table of Contents | Unit Home | Next Tutorial →

© 2026 COMP400 – Computer and Network Security • School of Computing and Information Systems, TrustOpen University • Unit 3: Authentication and Access Control