Week 3 - Authorisation

Question 1

What is the difference between authentication and authorization?

Answer 1

• Authentication: Verifying the identity of a user.
• Authorisation: Determining whether the authenticated user is permitted to perform a specific action

Question 2

How is authorization managed in access control models?

Answer 2

• subject level - what actions the user can perform
• object level - what actions are allowed on a specific resource

Question 3

What is the principle of least privilege?

Answer 3

Users should only be given the minimum access necessary to perform their job

reducing the risk of unauthorized access

Question 4

What are the two types of privilege escalation attacks?

Answer 4

• Vertical privilege escalation: Gaining access to a higher level account (e.g., user to admin).
• Horizontal privilege escalation: Gaining access to another user’s data or account at the same access level.

Question 5

common methods of executing privilege escalation attacks?

Answer 5

• Password guessing attacks.
• SQL injection attacks.