- [Narrator] As security professionals
one of the most important things that we do
is ensure that only authorized individuals
gain access to the information, systems,
and networks under our protection.
The access control process consists of three steps:
identification, authentication, and authorization.
During the first step of the process, identification,
an individual makes a claim about his or her identity.
The person trying to gain access
doesn't present any proof at this point.
They simply make an assertion.
It's important to remember that the identification step
is only a claim,
and the user could certainly be making a false claim.
Imagine a physical world scenario
where you want to enter a secure office building
where you have an appointment.
During the identification step of the process
you might walk up to the security desk and say,
"Hi, I'm Mike Chapple."
Proof comes into play during
the second step of the process, authentication.
During the authentication step,
the individual proves his or her identity
to the satisfaction of the access control system.
In our office building example,
the guard would likely want to see my driver's license
to confirm my identity.
Just proving your identity isn't enough
to gain access to a system, however.
The access control system also needs to be satisfied
that you are allowed to access the system.
That's the third step of the access control process,
authorization.
In our office building example the security guard
might check a list of that day's appointments
to see if it includes my name.
It's very important that you remember the distinction
between the identification and authentication phases.
Be ready to identify the phase associated
with an example of an access control mechanism.
So far we've talked about identification,
authentication, and authorization
in the context of gaining access to a building.
Let's now talk about how they work in the electronic world.
When we go to login to a system,
we most often identify ourselves using a username,
most likely composed of some combination
of the letters from our names.
When we reach the authentication phase,
we're commonly asked to enter a password
there are many other ways to authenticate,
and we'll talk about those later in this course,
as well as how strong access control systems
combine multiple authentication approaches.
Finally, in the electronic world,
authorization often takes the form
of access control lists that itemize
the specific file system permissions
granted to an individual user or group of users.
All access control systems provide
the means to accomplish these three steps
of the access control process.