Introduction
Every secure system must answer three questions before letting anyone do anything: Who are you? (authentication), What are you allowed to do? (access control / authorization), and How do we protect the data as it moves between machines? (network security). Together these three pillars are the heart of practical cyber security and one of the most heavily-tested areas in BCS, Bank IT-officer and other government IT recruitment exams.
This lesson builds the topic from first principles — starting with the difference between identification, authentication and authorization, moving through passwords and cryptographic protocols, then the classic access-control models (DAC, MAC, RBAC, ABAC and the Bell-LaPadula/Biba lattice models), and finally the network-security tool-kit: firewalls, IDS/IPS, VPN, TLS/SSL, IPSec and PKI, along with the common attacks each defends against. Every term is defined, every formula is worked out with real numbers, and the recurring exam traps are flagged.
Learning objectives
- Distinguish identification, authentication and authorization, and state the AAA framework.
- Explain the three (and extended five) authentication factors and what MFA/2FA really means.
- Describe how passwords are stored securely (hashing + salting) and the attacks against them (brute force, dictionary, rainbow table).
- Compare the major authentication protocols: Kerberos, RADIUS, TACACS+, SAML, OAuth 2.0, OpenID Connect and how SSO works.
- Compare the access-control models DAC, MAC, RBAC, ABAC and apply least privilege and the CIA triad.
- Apply the Bell-LaPadula (confidentiality) and Biba (integrity) rules correctly.
- Explain core network-security devices and technologies: firewall types, DMZ, IDS vs IPS, proxy, VPN, TLS/SSL, IPSec, PKI and digital certificates.
- Identify common network attacks (MITM, spoofing, sniffing, replay, DoS/DDoS) and their countermeasures.
- Solve calculative problems on password entropy, key space and hash/crack time.