-: The three A's of security.
The three A's of security are authentication,
authorization, and accounting.
Authentication occurs
when a person's identity is established with proof
and is confirmed by the system.
You do this every single day.
In fact, you did it when you logged into this course.
When you entered in your email address and your password,
you're making a claim
that you are the student who paid for this course.
And by doing that, you're checked by the system
and granted access.
Now, there are different ways to authenticate who you are.
In the real world, for example,
if you get pulled over for speeding by a police officer,
you may pull out your driver's license
and show them that it is you
and that you are who you say you are.
This is your proof.
Now, in the digital world,
we have five methods of authentication.
We have something you know,
which would be something like a password or a username.
We have something that you are,
which would be something like your fingerprint
or an eye scan, or a retina scan.
We have something you have.
This would be something like a token,
a driver's license, or a credit card.
It could be something you do,
which is the way that you speak
or the way that you sign your name.
And it can be somewhere you are,
which we know as your location factor
based on your GPS location.
Now, we're going to talk about each of those five factors
in much more depth when we get to our authentication lesson
later on in this course.
The second A is authorization.
Authorization occurs when a user is given access
to a certain piece of data
or certain areas of the building.
Have you ever walked into a building
and saw a sign that said restricted access,
authorized personnel only?
Well, that means you can't go in that area.
It may be something like a maintenance room
or some place where they have generators
and only the mechanics can get in there.
They have special keys or special badges
that will let them into those areas.
That area is some place you are not authorized to go.
The third A is accounting.
Accounting ensures that tracking of data,
computer usage, and network resources is maintained.
Now, when we do that,
it's usually put in something called a log file.
This is a file on a computer
that's essentially just a large text document.
And it keeps track of all sorts of things.
This may be all of the internet connections
that are leaving the network,
as shown here on the screen.
Or it may be a list of all of the people
who tried to log on to a particular file or website.
All sorts of different logs are kept on your computer
to keep track of all of the various things
that are being done.
And this is all to ensure good accounting practices
are being used.
Because if you have a data breach,
or you have some kind of an insider threat,
you can go back and look at the data in your log files
to figure out who did what and when.
That's what accounting allows you to do.
Now, if you have proof that somebody did something,
that they took an action,
we call this non-repudiation.
Non-repudiation simply means the user can't say
they didn't take the action
because you have proof they did.
For example, if you sent an email to me,
and you signed it with a digital signature,
you're the only person in the whole world
who has that private digital signature key.
I know for sure that you sent that email.
You can't tell me later that you didn't send it
because now I have proof.
That's non-repudiation.