Stage 1 · Lesson 5 of 8
Authentication and access control
proves who you are. Authorisation decides what you are allowed to do once you are in. Showing your ID at the door is authentication; the list of rooms your badge opens is authorisation, also called access control.
Passwords are the weakest common way to log in, so modern systems add (MFA), such as a code from an app as well as the password. The best methods resist , such as . Stored passwords should be protected with slow, salted hashing.
Authorisation should follow : each person and service gets only the access it needs. After you log in, a session or token keeps you logged in. For an attacker, stealing that token is often easier than stealing the password.
These ideas return in every path. A defender reads logon events, an AppSec engineer reviews access checks, and a tester reports broken ones.
Common trapmixing up authentication and authorisation, which is exactly how many access control bugs are born.
A question to check yourself, an AI practice session and 3 cheat sheet entries come with the full roadmap. Unlock
Resources for this stage
Start with· follow one of these
- CourseFreeProfessor Messer's Security+ (SY0-701) Course
Professor Messer · Beginner
Free video course whose early sections cover general security concepts, threats and cryptography at exactly the right depth
- PlatformFreeTryHackMe
TryHackMe · Beginner
The free pre-security and introductory rooms teach networking, Linux and web basics in guided, browser-based labs