Cybersecurity essentials · Lesson 2 of 5
Your identity is more than a password
Authentication checks a claimed identity. Authorization decides what that identity may do. Logging in successfully should not automatically grant access to everything.
Two different questions at the door
A building makes the distinction easier to see.
- Authentication
Check the person’s identity: “Who are you?”
- Authorization
Check the badge permissions: “Which doors may you open?”
- Allowed access
Open only the doors approved for that role.
Read the visualSomeone passes the identity check. Can they now open every door?
No. Authentication establishes the claimed identity; authorization still limits which doors that identity may open.
Avoid password reuse
Use a password manager to generate and store long, unique passwords. A breach of one account should not expose all your accounts.
Add another factor
Multifactor authentication combines distinct factor types, such as a password and a security key. Two knowledge-based secrets are not two distinct factors.
Protect recovery too
Recovery methods can bypass your usual sign-in. Treat recovery codes as secrets and never approve an unexpected authentication request.
Put it in context
Think of a building: an ID check establishes who you are. Your access badge determines which doors you can open.
A verified identity still needs carefully limited permissions.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.