When you log into your phone, it asks for a PIN, a fingerprint, or a face scan. That’s authentication - the system verifying who you are. Once you’re in, your phone lets you open your apps, but it doesn’t let your friend open your banking app with their fingerprint. That’s access control - the system deciding what you’re allowed to do.These two concepts are the gatekeepers of every secure system.
Authentication and authorization are often confused. Here’s the difference in one sentence: Authentication proves who you are. Authorization determines what you can do.
Authentication vs Authorization - who are you vs what can you do
Authentication always comes first. You prove your identity, and then the system checks what permissions your identity has. Without authentication, authorization is meaningless - the system doesn’t know who to authorize.
There are three categories of evidence you can use to prove your identity. Each one represents a different factor of authentication.
Something you ARE
Something you HAVE
Something you KNOW
Biometric authentication - physical or behavioral characteristics unique to you.Your body is the credential. You can’t forget it, lose it, or lend it to someone else (in most cases).
Biometric
How it works
Fingerprint scanner
Maps the unique ridges and patterns on your fingertip
Facial recognition
Analyzes the geometry of your face (distance between eyes, nose shape, jawline)
Retina / iris scan
Maps the unique blood vessel pattern in your retina or the color pattern in your iris
Voice recognition
Analyzes vocal characteristics like pitch, cadence, and tone
Gait analysis
Identifies you by the way you walk (used in advanced surveillance)
Typing patterns
Measures your keystroke dynamics - how fast you type and the pauses between keys
Strengths:
Extremely difficult to forge or steal
You always have it with you
Fast and convenient for users
Weaknesses:
Can’t be changed if compromised (you can’t get a new fingerprint)
Can be fooled in some cases (photos tricking facial recognition)
Privacy concerns - biometric data is highly sensitive
Biometric authentication - something you are
If your password is stolen, you change it. If your biometric data is stolen, you can’t change your fingerprint or your face. That’s why biometric databases require the highest level of protection.
Possession-based authentication - a physical object you carry.The system verifies that you have a specific item in your possession. Without the item, you can’t authenticate.
Something you have - ID badges and smart cards provide physical authentication
Item
How it works
Smart card
A card with an embedded chip that stores cryptographic keys - swiped or tapped at a reader
Security token (RSA key fob)
A device that generates a new one-time code every 30-60 seconds
Phone (for MFA codes)
Receives SMS codes, push notifications, or runs an authenticator app
USB security key (YubiKey)
A physical key you plug into your computer or tap via NFC to authenticate
Badge / access card
Swiped or held near a reader to unlock doors or systems
Strengths:
Adds a physical layer that remote attackers can’t easily bypass
Can be combined with other factors for strong authentication
Weaknesses:
Can be lost, stolen, or forgotten at home
Costs money to issue and replace
SMS codes can be intercepted through SIM swapping attacks
Hardware security keys (like YubiKey) are considered the most secure form of “something you have” because they are resistant to phishing. Even if you enter your password on a fake website, the key won’t authenticate with the wrong server.
Knowledge-based authentication - information stored in your memory.This is the most common and oldest form of authentication. You prove your identity by demonstrating you know a secret.
Something you know - passwords are the most common authentication factor
Item
How it works
Password
A secret string of characters you type to log in
PIN (Personal Identification Number)
A short numeric code, typically 4-8 digits
Security questions
Pre-set questions like “What was your first pet’s name?”
Passphrase
A longer sequence of words used as a password (e.g., “correct-horse-battery-staple”)
Pattern lock
A shape drawn on a grid of dots (common on Android phones)
PINs and keypads - another form of knowledge-based authentication
Strengths:
Free to implement - no hardware required
Easy for users to understand
Can be changed instantly if compromised
Weaknesses:
Can be guessed, cracked, phished, or shoulder-surfed
People reuse passwords across multiple sites
People choose weak passwords (“password123”, “qwerty”, birth dates)
Security questions often have guessable answers (especially from social media)
Multi-Factor Authentication requires you to prove your identity using two or more different factors. The key word is different - using two passwords (both “something you know”) is not MFA.
MFA example
Password (something you know) + Authenticator app code (something you have) = MFATwo different factor categories are used together.
Not MFA
Password (something you know) + Security question (something you know) = Not MFABoth are the same factor category. An attacker who compromises one may compromise both.
81% of data breaches involve weak or stolen passwords
Verizon DBIR
The average person has 80+ online accounts
LastPass
65% of people reuse the same password across multiple sites
Google
A 6-character password can be cracked in under 1 second
Hive Systems
An 8-character password with complexity can be cracked in ~39 minutes
Hive Systems
If all you have is a password, a single phishing email, a data breach on another site, or a brute-force attack can give an attacker full access to your account. MFA adds a second barrier: even if the attacker has your password, they still need your phone, your fingerprint, or your security key.
The strongest MFA combines factors from different categories. Fingerprint + security key is stronger than password + SMS code because both factors in the first combination are harder to steal remotely.
Once you’re authenticated (the system knows who you are), access control determines what you’re allowed to do. There are five major models, each with different rules for how permissions are assigned and enforced.To make these concrete, we’ll use examples from a fictional business you might recognize: Donuts & Dragons - the donut shop from the Cyber Defense Challenge.
RBAC - Role-Based Access Control
How it works: Access is determined by your role in the organization. Each role has a set of permissions, and you inherit the permissions of your assigned role.The principle: You get access based on your job title, not who you are personally.Donuts & Dragons example:
Role
Permissions
Barista
Use the POS system, view the menu, clock in/out
Shift manager
Everything a barista can do + view sales reports, approve refunds
Store manager
Everything a shift manager can do + view payroll, modify employee schedules, access the office computer
Owner
Full access to all systems, financial records, and security settings
The store manager can view payroll on the office computer, but a barista cannot - because their role doesn’t include that permission. If the barista gets promoted to shift manager, they automatically gain the new role’s permissions.Where you see it: Most companies, schools, and organizations use RBAC. Your school email probably gives teachers different permissions than students - that’s RBAC.
RBAC is the most common access control model in business. It’s easy to manage because you assign roles, not individual permissions. When someone changes jobs, you change their role - done.
DAC - Discretionary Access Control
How it works: The owner of a resource decides who gets access. It’s discretionary because the owner has full discretion - they can share access with anyone they choose.The principle: If you own it, you control who can use it.Donuts & Dragons example:The store manager has an office computer with the password. They decide to share the password with the assistant manager so they can access sales reports on weekends. The manager made a discretionary decision to share access - no system policy required it, and no administrator approved it.Where you see it: Google Docs, Dropbox, and most file-sharing systems use DAC. When you share a document and choose “anyone with the link can edit,” you’re using discretionary access control - you, as the owner, decide who gets access.The risk: DAC is flexible but dangerous. If the assistant manager writes the password on a sticky note and leaves it on the desk, anyone who finds it gets access. The owner’s judgment is the only safeguard.
DAC gives users significant power - and significant responsibility. In high-security environments, DAC is often considered too risky because a single user’s bad judgment can expose sensitive data.
MAC - Mandatory Access Control
How it works: A central authority (the system or an administrator) enforces access rules based on security classifications. Individual users cannot change these rules - they are mandatory.The principle: The system enforces access based on clearance levels and data classifications. No exceptions.Donuts & Dragons example:This model doesn’t naturally fit a donut shop - it’s designed for high-security environments. But imagine a military scenario:
Classification
Who can access
Unclassified
Anyone
Confidential
Personnel with Confidential clearance or higher
Secret
Personnel with Secret clearance or higher
Top Secret
Only personnel with Top Secret clearance
A soldier with Secret clearance can read Confidential and Unclassified documents, but cannot access Top Secret documents - even if a general verbally tells them it’s okay. The system enforces the rules, not the people.Where you see it: Military systems, intelligence agencies, and some government networks. The operating system SELinux (Security-Enhanced Linux) implements MAC.
The key difference between MAC and DAC: in DAC, the owner decides who gets access. In MAC, the system decides - and no individual can override it.
ABAC - Attribute-Based Access Control
How it works: Access is determined by attributes - characteristics of the user, the resource, and the environment. These attributes are evaluated by rules at the time of the request.The principle: Access depends on context - who you are, what you’re requesting, when, where, and how.Donuts & Dragons example:The baker at Donuts & Dragons can access the kitchen inventory system - but only during their scheduled shift hours (6 AM - 2 PM) and only from the kitchen terminal. If the baker tries to log into the inventory system at 10 PM from their home laptop, access is denied.Attributes evaluated:
Attribute type
Example
User attribute
Role = Baker, Department = Kitchen
Resource attribute
System = Kitchen Inventory
Environment attribute
Time = 6 AM - 2 PM, Location = Kitchen terminal
Action attribute
Action = View inventory (allowed), Action = Delete records (denied)
Where you see it: Cloud platforms like AWS use ABAC extensively. An IAM policy might say: “Allow access to S3 buckets tagged with department=engineering only for users tagged with department=engineering.”
ABAC is the most flexible model. It can express any rule that RBAC, DAC, or MAC can - plus rules based on time, location, device type, and other context that the simpler models can’t handle.
RuBAC - Rule-Based Access Control
How it works: Access is determined by predefined rules configured by an administrator. These rules apply to all users equally, regardless of identity or role.The principle: The rule applies to everyone, no exceptions.Donuts & Dragons example:The Donuts & Dragons store has a firewall with a rule: block all incoming traffic from IP addresses outside the United States. This rule applies to everyone - customers, employees, vendors, even the owner. If the owner travels to Europe and tries to access the POS system remotely, the firewall blocks them. The rule doesn’t care who you are.More examples:
A router rule that blocks all traffic on port 23 (Telnet)
A time-based rule that disables Wi-Fi access after business hours
A content filter that blocks access to social media sites on the company network
Where you see it: Firewalls, routers, and content filters are the most common implementations. The rules are configured once and applied universally.
RuBAC and RBAC sound similar but are fundamentally different. RBAC assigns permissions based on your role (manager, barista). RuBAC applies rules universally regardless of your role (the firewall blocks port 23 for everyone).
For each scenario, identify which access control model is the best fit.
1. A hospital gives doctors access to patient records, but nurses can only view vitals and medication schedules
RBAC (Role-Based Access Control)Access is determined by the user’s role - doctor vs nurse. Each role has different permissions. The system doesn’t care who the individual is, only what their role is.
2. A teacher shares a Google Doc with specific students in their class
DAC (Discretionary Access Control)The teacher (the resource owner) decides who gets access. They can share with anyone they choose, revoke access at any time, and set permissions (view, comment, edit).
3. A classified military document can only be accessed by personnel with Top Secret clearance
MAC (Mandatory Access Control)Access is enforced by the system based on the document’s classification level and the user’s clearance level. No individual can override this - even a general can’t grant access to someone without the proper clearance.
4. An employee can access the company VPN only between 8 AM and 6 PM, only from a company-issued laptop, and only from within the United States
ABAC (Attribute-Based Access Control)Access depends on multiple attributes: time (8 AM - 6 PM), device type (company laptop), and location (United States). ABAC is the only model that evaluates this many contextual factors simultaneously.
5. A firewall blocks all inbound traffic on port 22 (SSH) from the public internet
RuBAC (Rule-Based Access Control)A predefined rule applies universally to all traffic. The firewall doesn’t know or care about the user’s identity - it enforces the rule on every packet.
6. A retail store's POS system allows cashiers to process sales but only managers can issue refunds over $50
RBAC (Role-Based Access Control)Permissions are tied to the role (cashier vs manager), not to individual users. A new cashier automatically gets cashier permissions; a promoted manager automatically gets refund authority.
Systems verify who you are using three factors: something you know (password), something you have (phone), or something you are (fingerprint).
2
MFA combines multiple factors
Multi-Factor Authentication requires two or more different factor types. Two passwords is not MFA - you need factors from different categories.
3
Authorization determines permissions
After authentication, access control models decide what you can and can’t do. The five major models (RBAC, DAC, MAC, ABAC, RuBAC) each handle this differently.
4
Context matters
The best access control model depends on the organization’s needs. A donut shop uses RBAC. A military base uses MAC. A cloud platform uses ABAC. There is no single right answer.
