MODULE 3: Authentication & Access Control

Lesson 1: Password Policies & Multi-Factor Authentication (MFA)

1. What Is Authentication?

Authentication = Verifying identity.
It answers the question: “Are you really who you claim to be?”

Methods:

• Something you know (password, PIN)
• Something you have (phone, token)
• Something you are (fingerprint, face)

2. Password Best Practices

Modern password security is not just “use a strong password.”
It includes policies to reduce risk.

Strong Password Requirements

• Minimum 8–12 characters
• Mix of uppercase, lowercase, numbers, symbols
• No dictionary words
• No personal info (birthday, name, phone)

Common Weak Password Mistakes

Using the same password everywhere
Short/simple passwords (12345, password123)
Writing passwords on paper
Sharing passwords

3. Password Policy in Organizations

Companies enforce password rules:

• Password expiration: every 60–90 days
• Password history: cannot reuse last 5–10 passwords
• Account lockout after failed attempts
• Minimum password length: 12+ characters

These reduce brute-force and guessing attacks.

4. Multi-Factor Authentication (MFA)

MFA adds another layer of protection.

Types of MFA:

• SMS codes
• Authenticator apps (Microsoft Authenticator, Google Authenticator)
• Email verification
• Hardware tokens (YubiKey)
• Biometrics (fingerprint, Face ID)

Why MFA Is Important:

Even if the password is stolen, the attacker cannot log in without the second factor.

MFA stops 99% of account-based attacks.

Lesson 2: Role-Based Access Control (RBAC)

What is RBAC?

RBAC = Assigning permissions based on roles, not individuals.

Example roles:

• Accountant
• HR manager
• IT support
• Admin
• Security analyst

Each role has specific permissions.

Why Organizations Use RBAC

• Simple management
• Less chance of errors
• Users get only what they need
• Easy onboarding/offboarding
• Improved security

Example: RBAC in a Company

Finance department:

• Can access payroll system
• Cannot access IT server configs

IT Admin:

• Can manage servers
• Cannot access payroll or HR data

HR:

• Can view employee records
• Cannot modify network firewall rules

Principle of Least Privilege

Users should have only the access they need to do their job nothing more.

Example:
A receptionist does not need permission to delete files from the company server.

Lesson 3: Identity & Access Management (IAM)

IAM = A complete system of controlling who enters the network and what they can do.

Components of IAM

1. Identity Authentication

Verifying who the user is (password, MFA).

2. Authorization

Defining what the user is allowed to access.

3. Single Sign-On (SSO)

Login once → access multiple systems without logging in again.

Used in:

• Microsoft 365
• Google Workspace
• Enterprise apps

4. Identity Providers (IdP)

Systems that manage authentication:

• Azure Active Directory
• Okta
• Google Identity
• AWS IAM

5. Directory Services

Store identity information:

• Active Directory (AD)
• LDAP directories

Why IAM Is Critical

• Centralized user management
• Secure access control
• Easy onboarding/offboarding
• Better compliance (ISO, GDPR)
• Reduced insider risk

Lesson 4: Privileged Access Management (PAM)

PAM controls access for high-privilege accounts, which are the most dangerous if compromised.

What Is a Privileged Account?

Accounts with elevated permissions:

• Domain Admin
• Database Admin
• Network Admin
• Root user (Linux)
• Service accounts
• Administrator (Windows)

These accounts can:

• Modify system settings
• Remove logs
• Install software
• Access sensitive data

They are the #1 target for attackers.

PAM Best Practices

1. Limit Number of Admin Accounts

Only a few people should be administrators.

2. Use Just-In-Time (JIT) Access

Give temporary admin rights only when needed.

3. Use Privilege Elevation Tools

Examples:

• CyberArk
• BeyondTrust
• Microsoft PIM
• Thycotic

4. Session Recording

All admin activities should be recorded and monitored.

5. Stronger MFA for Admin Access

Admins should use:

• MFA
• Hardware tokens
• Secure VPN

6. Split Accounts

Admins should have:

• 1 normal user account
• 1 admin account

They should never browse the internet using admin accounts.

Lesson 5: Account Security Best Practices

1. Account Lockout Policies

After X failed login attempts → account gets locked temporarily.
This stops brute-force attacks.

2. Disable Inactive Accounts

Old accounts = major risk.
Examples:

• Former employees
• Old vendor access
• Expired service accounts

Disable immediately.

3. Monitor Login Activity

Companies use:

• SIEM logs
• Security dashboards
• Alerts for unusual activity

Examples:

• Login attempts from unknown countries
• Multiple failed attempts
• Logins outside business hours

4. Enforce Session Timeouts

If a user is inactive for 5–10 minutes → auto logout.

Stops unauthorized use when user forgets to log out.

5. Strong Email Security

Email = #1 entry point for attacks.

Use:

• MFA
• Spam filters
• Block dangerous attachments
• Train users to spot phishing

6. Regular Access Reviews

Managers periodically review:

• Who has access to what
• Remove unnecessary permissions

Reduces insider threats.

Module 3 Summary

Students now understand:

• Why passwords alone are not enough
• How MFA protects users
• How RBAC assigns permissions based on roles
• How IAM systems manage identities
• Why privileged accounts are dangerous and require PAM
• Best practices for securing all accounts

This module answers the question:
“How do we control and secure user access inside an organization?”