ISC2 Certified in Cybersecurity (CC)Access Controls ConceptsEasy
A small business is setting up its first network and needs to ensure that only authorized employees can access the company's shared drive. Which of the following access control concepts is primarily concerned with verifying the identity of an individual before granting access?
- AAuthorization
- BLeast Privilege
- CAccountability
- DAuthentication
Show answer & explanationAnswer & explanation
Correct answer: D. Authentication
Authentication is the process of verifying a user's claimed identity. Before access can be granted (authorization), the system must confirm who the user is.
Why the other options are wrong
- A. Authorization determines what an authenticated user can do, not who they are.
- B. Least Privilege is a principle that limits access to only what is necessary for a user's function.
- C. Accountability tracks actions performed by an identified and authenticated user.
Authentication
The process of verifying the identity of a user, process, or device.
- Confirms 'who you are'
- Typically follows identification
- Uses factors like passwords, biometrics, tokens
Memory trick: Identify, Authenticate, Authorize: 'Who are you, prove it, what can you do?'