Original subtitles

1

The three A's of security.

2

The three A's of security are authentication,

3

authorization, and accounting.

4

Authentication occurs

5

when a person's identity is established with proof

6

and is confirmed by the system.

7

You do this every single day.

8

In fact, you did it when you logged into this course.

9

When you entered in your email address and your password,

10

you're making a claim

11

that you are the student who paid for this course.

12

And by doing that, you're checked by the system

13

and granted access.

14

Now, there are different ways to authenticate who you are.

15

In the real world, for example,

16

if you get pulled over for speeding by a police officer,

17

you may pull out your driver's license

18

and show them that it is you

19

and that you are who you say you are.

20

This is your proof.

21

Now, in the digital world,

22

we have five methods of authentication.

23

We have something you know,

24

which would be something like a password or a username.

25

We have something that you are,

26

which would be something like your fingerprint

27

or an eye scan, or a retina scan.

28

We have something you have.

29

This would be something like a token,

30

a driver's license, or a credit card.

31

It could be something you do,

32

which is the way that you speak

33

or the way that you sign your name.

34

And it can be somewhere you are,

35

which we know as your location factor

36

based on your GPS location.

37

Now, we're going to talk about each of those five factors

38

in much more depth when we get to our authentication lesson

39

later on in this course.

40

The second A is authorization.

41

Authorization occurs when a user is given access

42

to a certain piece of data

43

or certain areas of the building.

44

Have you ever walked into a building

45

and saw a sign that said restricted access,

46

authorized personnel only?

47

Well, that means you can't go in that area.

48

It may be something like a maintenance room

49

or some place where they have generators

50

and only the mechanics can get in there.

51

They have special keys or special badges

52

that will let them into those areas.

53

That area is some place you are not authorized to go.

54

The third A is accounting.

55

Accounting ensures that tracking of data,

56

computer usage, and network resources is maintained.

57

Now, when we do that,

58

it's usually put in something called a log file.

59

This is a file on a computer

60

that's essentially just a large text document.

61

And it keeps track of all sorts of things.

62

This may be all of the internet connections

63

that are leaving the network,

64

as shown here on the screen.

65

Or it may be a list of all of the people

66

who tried to log on to a particular file or website.

67

All sorts of different logs are kept on your computer

68

to keep track of all of the various things

69

that are being done.

70

And this is all to ensure good accounting practices

71

are being used.

72

Because if you have a data breach,

73

or you have some kind of an insider threat,

74

you can go back and look at the data in your log files

75

to figure out who did what and when.

76

That's what accounting allows you to do.

77

Now, if you have proof that somebody did something,

78

that they took an action,

79

we call this non-repudiation.

80

Non-repudiation simply means the user can't say

81

they didn't take the action

82

because you have proof they did.

83

For example, if you sent an email to me,

84

and you signed it with a digital signature,

85

you're the only person in the whole world

86

who has that private digital signature key.

87

I know for sure that you sent that email.

88

You can't tell me later that you didn't send it

89

because now I have proof.

90

That's non-repudiation.