How it works
Authentication proves identity. Authorization decides what that identity may do. Strong security separates those ideas and reduces the value of stolen credentials.
Use multi-factor authentication for important accounts, remove old access, avoid shared administrator accounts, and review unusual login signals.
Common error
A longer password helps, but it does not replace MFA, account lifecycle management, or least privilege.
Worked example
A teacher logs in successfully but cannot edit payroll records. Separate two access decisions.
Evidence
Identity check: successful
Role: teacher
Payroll edit permission: absentAuthentication succeeded, while authorization correctly denies an action outside the role. Giving every authenticated user edit rights would weaken security. Review role assignments only if the documented job requirement actually includes the denied task.
Exercises
1.3.1
Are a password and a PIN necessarily two distinct authentication factors? Explain.
Show solution
Not necessarily. Both are knowledge factors. Multifactor authentication requires different factor categories, such as knowledge plus possession.
1.3.2
A temporary administrator changes roles. What account lifecycle action should follow?
Show solution
Remove unnecessary elevated permissions promptly, retain an individual identity for accountability, and verify that the new role retains only the access its work requires.