Lesson 9 — Intermediate

Authentication & Access Control (MFA)

Har security ka darwaza login hai. Is lesson mein hum authentication aur authorization ka farak, MFA ke factors, access control ke models (DAC/MAC/RBAC/ABAC) aur password security ki sahi practice samjhenge — HR portal se server tak sab isi par chalta hai.

⏱ 14 min• Intermediate• Web Security

Authentication vs Authorization

WHAT

Authentication (AuthN) = identity verify karna — tum sach mein tum ho? Authorization (AuthZ) = permission check — kya tumhe ye karne ki ijazat hai? Inke saath Accounting (log) milke AAA banate hain.

WHEN

WHERE

Phone lock, email login, server SSH, office HR portal — authentication har access point pe hota hai, authorization har button/action pe.

Trick: AuthN = kaun (identity), AuthZ = kya (permission). Login hona = authentication. Login ke baad payroll dekhna allowed hai ya nahi = authorization.

MFA ke factors

Factors (5 type):
  Something you KNOW  : password, PIN, security question
  Something you HAVE  : phone (OTP), smart card, token
  Something you ARE   : fingerprint, face, iris (biometrics)
  Something you DO    : typing pattern, signature
  Somewhere you ARE   : location (bonus factor)

MFA = Multi-Factor (ALAG CATEGORY ke 2+ factors)
  Password (know) + OTP (have) = MFA ok
  Password + PIN = MFA NAHI (dono "know")

MFA ke forms:
  SMS OTP           : sabse common, par SIM-swap risk
  Authenticator app : better (TOTP, offline chalta hai)
  Hardware key      : sabse strong (FIDO2/YubiKey)
  Passkeys          : naya standard (password hi nahi)

Desi rule: India mein MFA fraud ka #1 tarika hai — OTP kisi ko bata dena. Bank/CERC kabhi call pe OTP nahi maangta. OTP = tumhara private factor, share kabhi nahi.

Access control ke models

DAC (Discretionary) : OWNER khud decide kaun dekh sakta hai
                      (file right-click -> share) — flexible, kam safe
MAC (Mandatory)      : SYSTEM label lagata hai (secret/top secret)
                      — user nahi chaahe tab bhi policy chalti hai
                      — defence/govt classified data
RBAC (Role Based)    : ROLE ke hisaab se permission
                      (HR = payroll, Dev = code repo, intern = read)
                      — corporate ka sabse common model
ABAC (Attribute)     : attributes se condition
                      (office hours only, company device only)

PRINCIPLE : LEAST PRIVILEGE — sirf utna access jitna kaam ke liye
SUB-PRINCIPLE : separation of duties (ek hi insaan sab na kare)

Bank vault se samjho: guard check karta hai kaun andar (AuthN), locker kaun sa kholega (AuthZ), aur camera sab record karta hai (Accounting). Teenon ho tabhi system secure hai.

Password security ki sahi practice

Length > complexity: 4 random words wali passphrase (20+ char) P@ss1! se strong hai.
Har site UNIQUE: password manager use karo — ek leak doosri site na le jaaye.
Server side: hash + salt (bcrypt/Argon2) — plain text kabhi store nahi.
Brute force defense: rate limiting + account lockout + MFA.
Breach check: apna email password breach lists mein check karo, milta hai toh badlo.
Purani advice chhodo: "3 mahine badlo" ab weak — unique + long + MFA better hai.

Manager ki tip: ek master passphrase + MFA — baaki sab manager sambhalega. Insaan yaad rakhne ki koshish mein hi weak password bana deta hai.

Exercise

Question: Tumhari identity verify karna kaunsa hai — authentication ya authorization?

Question: MFA mein "M" kya represent karta hai? (multi/most)

Question: Password ko server pe kaise store karna chahiye — plain text ya hashed?

Common mistakes

Authentication aur authorization ulta bolna: AuthN = identity (kaun ho), AuthZ = permission (kya chalega). Interview mein zaroor poochha jaata hai — trick: N = name, Z = permission.
OTP share kar diya kyunki MFA laga hai: Agar OTP kisi ko bata diya toh factor wahi bypass ho gaya. MFA tabhi bachata hai jab factors private rahein.
Password rules purane follow karna: Aaj sabse zyada bruteforce-resistant cheez hai length + uniqueness + MFA. Baar baar complex badalna ab strategy nahi hai.

Desi example: UPI mein double lock

UPI payment mein tumhe PIN chahiye (something you know) aur tumhara phone/SIM (something you have) — dono category ke factors = MFA. Isliye SIM swap fraud itna khatarnaak hai:

Factor 1 (know) : UPI PIN
Factor 2 (have) : tumhara phone (SIM/OTP)
Attack  : SIM swap -> doosre ke phone pe OTP
Defense : SIM lock + app-based OTP + PIN safe

Exam mapping (TCS / Security+ / Interview)

TCS NQT: authentication vs authorization — direct 1Q.
Security+: MFA factors + least privilege core objectives.
Interview: "MFA ke factors batao" + "RBAC kya hai" dono common hain.
Trap: "Password + PIN = MFA" — galat, dono same category (know) hain.

Lesson complete?

Authentication clear. Agla lesson — Wireless Security — mein dekhenge Wi-Fi ke standards (WEP, WPA2, WPA3) aur uske attacks.