- 2074 Bhadra · 4 marks
Authentication as security mechanism
Short answer
Authentication verifies identity before granting access, forming the basis for authorization, auditing, and access control. Without it, permissions become useless. Methods include passwords, tokens, biometrics, and multi-factor authentication.
How is authentication an essential mechanism for maintaining security? Explain.
Authentication is the process of verifying the identity of a user, process or device before access is given. It is essential because every other security mechanism (authorisation, access control, auditing) depends on knowing correctly who is making the request. If identity can be faked, ACLs and permissions become useless.
Why it is essential
- Ensures only legitimate users enter the system (prevents masquerading).
- Gives accountability: actions are recorded against a verified identity in logs.
- Protects confidentiality and integrity of data by allowing access only to the right person.
- Starting point for authorisation: permissions are assigned to authenticated identities.
Methods of authentication
- Something the user knows: password, PIN. Weak if guessable; so use long passwords, hashing with salt, expiry.
- Something the user has: smart card, token, mobile OTP.
- Something the user is: biometrics (fingerprint, iris, face).
- Multi-factor authentication: two or more of the above, e.g. password + OTP.
- Challenge-response: the system sends a random challenge; the user returns a result computed with a secret key, so the secret never travels.
Typical login flow (UNIX)
user name + password
|
hash(password + salt)
|
compare with stored hash in /etc/shadow
|
match -> access granted
Authentication threats: password guessing, login spoofing, sniffing. Countermeasures: account lockout after failures, encrypted channels and trusted login paths.
✓ Answer checked by Claude Opus 5.5 (high effort)