Authorisation +Authentication

Authorisation +Authentication

1. Authorisation

   • Giving permission (authority) for users to access data
   • Different users are allowed to access different data
   • Why?
     • Restrict access to users to avoid unauthorised access and changes to the data
     • Data may be stolen or used commercially and illegally
     • Personal data has to legally be kept secure
   • Levels of access
     • Read Only: a user is allowed to view data
     • Create: a user is allowed to create new data records
     • Write: a user is allowed to make changes to data
     • Delete: a user is allowed to delete data

2. Authentication

   • 3 ways to authenticate
     • Something you have; mobile phone, credit card or hardware security token
     • Something you are; voice recognition, fingerprint, retinal scan
     • Something you know; password, PIN
   • Effectiveness of password being maintained
     • Force password change frequently
     • Enforce minimum length password
     • Must contain numbers and letters
     • Cannot reuse passwords
     • 3 incorrect password attempts ; account is locked