Authentication and Access Control

1. Why Access Control Matters

Imagine that an organization’s marketing intern accidentally deletes a shared folder containing client files. The intern didn’t mean to cause harm, but their account had full access to shared drives instead of limited permissions. In another case, an employee leaves the company but their log-in credentials remain active, giving them continued access to confidential documents. Both situations highlight the same problem: the organization failed to control who can do what inside the network.

In the previous lesson, you learned how VPNs and encryption protect data as it travels across public networks. Once that data arrives, it still needs protection within the organization’s internal systems. This is where access control comes in. Access control is the process of managing which users, devices, or processes can access specific resources and perform certain actions. It defines what each person is allowed to view, modify, or share within a network.

Strong access control ensures that employees can complete their tasks efficiently while preventing unauthorized activity. Without it, even trusted users can unintentionally expose sensitive information or make changes that put systems at risk. Effective access control balances usability—making sure people can do their jobs—with security, which limits potential damage from accidents or malicious actions.

think about it

If every employee in an organization had full access to all company files, what problems could occur? How could access control policies prevent those risks?

key concept

Access control protects internal systems and data by defining what users are allowed to do once they are authenticated.

terms to know

Permissions

The specific actions a user or system is allowed to perform, such as viewing, editing, or deleting files.

Access Control

The process of managing which users, devices, or processes can access specific resources and perform certain actions within a network.

Usability

The ease with which authorized users can access the systems and resources they need to perform their work.

2. Authorization and Authentication

Before a system can decide what a user is allowed to do, it first needs to know who that user is. This first step is called authentication, which verifies identity using credentials such as a username, password, digital certificate, or token. You learned in the previous lesson that authentication protects the network by allowing only trusted users or devices to connect securely.

Once authentication is complete, the next step is authorization. Authorization determines what actions or resources an authenticated user is permitted to access. For example, after logging in, a network administrator may be authorized to install software or view system logs, while a regular employee can only access shared documents. Both users are authenticated, but their authorization levels are very different.

If authentication fails, access is denied altogether. But if authorization is misconfigured, authenticated users might gain access to resources they shouldn’t. Imagine an HR intern who logs in successfully but can also view payroll data meant only for managers. The log-in worked correctly, but the authorization settings failed to limit permissions appropriately.

When combined, authentication and authorization form a layered defense. Authentication ensures users are who they claim to be, and authorization ensures they can only do what they are permitted to do. Together, they protect systems from both external intrusions and internal mistakes. The following diagram summarizes the difference between authentication, which verifies identity, and authorization, which determines what an authenticated user can do.

try it

A school’s network allows both teachers and students to log in successfully. After logging in, students can modify or delete assignment files that should be read only.

Is this an authentication issue or an authorization issue?

This is an authorization issue. Authentication worked correctly because users were able to log in.

What specific change would fix the problem?

The problem occurs because student accounts were granted permissions beyond what they should have. The fix would be to adjust authorization settings so student accounts have read-only access, while teachers retain edit and delete permissions.

key concept

Authentication verifies identity, while authorization controls what an authenticated user can access or do within a system.

terms to know

Credentials

Information or objects, such as passwords or certificates, used to prove a user’s or device’s identity during authentication.

Authorization

The process of determining what an authenticated user is allowed to access or do.

3. Principle of Least Privilege

One fundamental concept underlying all access control models is the principle of least privilege. This principle states that users, systems, and applications should only have the minimum access necessary to perform their specific tasks, no more and no less.

Every user or system account is assigned a set of privileges, which are the specific actions that account is allowed to perform. Privileges might include viewing files, editing data, installing software, or changing system settings. Managing these privileges carefully prevents both mistakes and misuse of network resources.

Applying this principle limits the potential damage caused by mistakes or attacks. If an account with limited privileges is compromised, the attacker’s access will also be limited. It also prevents users from accidentally changing or deleting important system files that they do not need for their work. The following diagram illustrates how the principle of least privilege limits access to only what each role or user needs to perform their specific job duties.

Imagine a customer service representative who needs to update customer contact information but does not need to change account balances. Granting that employee access to financial records would go beyond what their job requires. By assigning only the permissions necessary for their responsibilities, the company reduces both the risk of data loss and the chance of human error.

The principle of least privilege improves both security and efficiency. When employees only see the tools and data relevant to their work, systems become simpler to navigate and easier to protect.

try it

You are managing accounts for your organization’s IT department. A support technician is assigned to fix network printers and requests elevated permissions to complete the task.

How should access be granted to follow the principle of least privilege?

The technician should receive only the specific permissions required to manage printers, and only for the duration of the task. Full or permanent administrative access would exceed what is necessary and increase security risk. This approach limits potential damage while still allowing the work to be completed.

terms to know

Principle of Least Privilege

A security guideline stating that users, systems, or processes should only have the access necessary to perform their assigned functions.

Privileges

The specific permissions or rights that determine what actions a user or system can perform within a network or application.

4. Role-Based Access Control (RBAC)

Managing access for every individual user can quickly become complicated. RBAC simplifies this process by assigning permissions to roles rather than to each person. A role represents a job function within an organization, and each role has specific privileges that match its responsibilities. Users are then added to one or more roles, automatically inheriting all the permissions that those roles provide.

The following table shows how permissions might be organized across different roles in a company. Each role includes only the access needed for its specific duties.

This structure allows administrators to manage access efficiently and consistently. When an employee joins the organization, changes roles, or leaves, administrators only need to update their assigned role instead of modifying multiple permissions manually. RBAC also supports the principle of least privilege because each role contains only the access necessary for its specific job function. The following diagram shows how RBAC organizes users, roles, and permissions to simplify management and maintain security.

EXAMPLE

Consider an IT employee named Alex who handles both network administration and database management. Alex is assigned two roles: Network Admin and Database Manager. The Network Admin role includes permissions to configure routers, manage firewalls, and set up VPNs. The Database Manager role provides access to perform data backups, manage security, and facilitate database migration. If Alex transitions into cybersecurity, the administrator can simply remove the Network Admin role and assign a Security Operations role. This adjustment automatically updates Alex’s permissions without requiring individual changes to dozens of settings.

EXAMPLE

To see how RBAC works in practice, imagine you are setting up access for three employees in a company network. Each employee’s responsibilities require a different level of access to company data and systems.

• Avery works in customer service and only needs to view customer records to answer inquiries.
• Jordan is a department manager who reviews and approves updates made by employees in their team.
• Taylor is an IT administrator who manages user accounts, security settings, and network configurations.

Based on these job functions, each person should be assigned the role that best matches their duties.

Avery: The Customer Service Representative role is the best fit because it allows Avery to view customer records but not make any edits. Restricting Avery’s permissions prevents accidental changes or deletions while still providing the information needed to assist customers.

Jordan: The Department Manager role is appropriate for Jordan since it includes permissions to edit and approve records created by others. This access level reflects Jordan’s supervisory responsibilities without granting administrative control over system settings.

Taylor: The IT Administrator role suits Taylor because it includes full management privileges, such as creating user accounts and adjusting system configurations. These permissions are necessary for maintaining network operations and supporting other employees.

By assigning roles based on responsibilities, each employee receives only the access they need to perform their job. This approach demonstrates both RBAC and the principle of least privilege, ensuring that access is aligned with job requirements and minimizing the risk of errors or unauthorized activity.

try it

A midsize company recently upgraded its internal network and discovered multiple access control problems. A sales representative was able to view confidential HR data, and an intern accidentally deleted marketing project files. Management wants to correct these issues without slowing down daily work.
The company has the following departments:

• Sales
• Human Resources
• Finance
• IT Support
• Executives

Using RBAC and the principle of least privilege, identify one specific access change that would prevent each of the following issues:

• Unauthorized access to HR data
• Accidental deletion of shared files

Focus on how permissions should be limited by role rather than assigned to individuals.

How should roles and permissions be adjusted to prevent these problems while still allowing employees to do their jobs?

HR data should be restricted to a Human Resources role, preventing Sales or other departments from viewing sensitive employee information. Intern and entry-level roles should be assigned limited or read-only permissions for shared folders to prevent accidental deletions. By grouping permissions by role and limiting access to only what each role requires, the company improves security without reducing productivity.