Learning Objectives
By the end of this chapter, you will be able to:
- Define unauthorized access and identify common ways attackers gain it.
- Describe the three main types of authentication.
- Explain the importance of strong passwords and two-factor authentication.
- Differentiate between authentication and authorization.
- Suggest access-control measures for a business.
Unauthorized Access
Unauthorized access is the act of gaining access to a computer system, network, or data without permission. This is a major security threat that can lead to data theft, fraud, and system damage.
Unauthorized access can come from outsiders (hackers) or insiders (employees using access they should not have, or former staff whose accounts were never removed).
Common ways attackers gain access
| Method | How it works |
|---|---|
| Password guessing | Trying common or leaked passwords (“123456”, “password”, date of birth). |
| Phishing | Fake emails, SMS, or websites trick users into revealing passwords or OTPs. |
| Shoulder surfing | Watching someone type a PIN or password. |
| Unattended devices | Using a computer that was left logged in. |
| Default credentials | Routers, CCTV, and software left with factory usernames and passwords. |
| Exploiting weaknesses | Using unpatched software vulnerabilities to bypass login. |
Protection: Access Control and Authentication
The primary way to protect against unauthorized access is through access control, which is the process of restricting access to resources. Access control is typically based on authentication, which is the process of verifying the identity of a user.
There are three main factors (or types) of authentication:
- Something you know: This is the most common form of authentication.
- Example: A password or a PIN.
- Something you have: This involves possessing a physical object.
- Example: An ATM card, a smart card, or a security token that generates a one-time code.
- Something you are: This uses a unique physical characteristic of the user.
- Example: Biometrics, such as a fingerprint scan, facial recognition, or an iris scan.
| Factor | Example | Strength | Weakness |
|---|---|---|---|
| Something you know | Password, PIN | Cheap and easy | Can be guessed, stolen, or phished |
| Something you have | ATM card, phone OTP, token | Attacker needs the object | Can be lost or stolen |
| Something you are | Fingerprint, face | Hard to share or forget | Cannot be changed if leaked; privacy concerns |
Strong Authentication
To provide strong security, it is best to use more than one factor of authentication. Two-Factor Authentication (2FA) combines two of these different factors. For example, to access your bank account, you might need your password (something you know) and a one-time code sent to your phone (something you have).
flowchart LR
T[Unauthorized Access Threat] --> AC[Access Control]
AC --> AUTH[Authentication]
AUTH --> K[Something You Know]
AUTH --> H[Something You Have]
AUTH --> B[Something You Are]
K --> 2FA[Two-Factor Authentication]
H --> 2FA
B --> 2FA
2FA --> OK[Authorized Access]
Figure 1: Unauthorized Access Threats and Authentication Controls
Note: a password plus a security question is not 2FA, because both are “something you know.”
What makes a strong password?
- At least 12 characters; a passphrase such as
Momo-Rain-Bus-42!is long and easy to remember. - Mix of upper and lower case letters, numbers, and symbols.
- Not based on names, birthdays, or phone numbers.
- Unique for each account, so one leak does not unlock everything; a password manager helps.
Authentication vs Authorization
- Authentication answers “Who are you?” (logging in).
- Authorization answers “What are you allowed to do?” (permissions after login).
For example, a bank teller and a branch manager both log in to the core banking system (authentication), but only the manager can approve large transactions (authorization). Giving each user only the access they need is called the principle of least privilege.
Other Protective Measures
- Automatic screen lock and logout after inactivity.
- Account lockout after several wrong password attempts.
- Removing accounts of staff who leave the organization.
- Audit logs that record who accessed what and when.
- Firewalls and encryption to protect networks and data (see network security).
- User awareness training against phishing.
Nepal Context
Nepali banks and wallets such as eSewa and Khalti use OTPs, MPINs, and fingerprint or face login on mobile apps. Many fraud cases in Nepal involve victims being tricked into sharing an OTP over the phone by someone pretending to be from a bank or wallet company. Banks repeatedly warn: never share your OTP or PIN with anyone, including bank staff.
Business Scenario
A cooperative in Chitwan finds that a former staff member’s login was used weeks after he left to view member savings records. The cooperative responds by disabling accounts on the last working day, introducing role-based permissions (tellers cannot edit member records), enabling 2FA for the admin accounts, and reviewing audit logs every month.
Summary
Unauthorized access is a major security threat, coming from outsiders and insiders through guessing, phishing, shoulder surfing, and unpatched systems. The main defense against it is authentication, the process of verifying a user’s identity. Authentication can be based on something the user knows (a password), has (a token), or is (a fingerprint). The strongest security is achieved by using two-factor authentication, which combines two of these different methods. Authentication is followed by authorization, which limits what each user can do, ideally under the principle of least privilege.
Key Takeaways
- Unauthorized access is gaining access without permission.
- Authentication is the process of verifying identity.
- The three factors of authentication are something you know, have, and are.
- Two-factor authentication (2FA) provides the strongest security.
- Authorization decides what an authenticated user is allowed to do.
Discussion Questions
- What makes a password “strong”?
- What are the potential privacy concerns with using biometrics for authentication?
- What are some common websites or services you use that offer two-factor authentication?
Exam-Style Questions
Short answer
- What is unauthorized access? Give two examples.
- Differentiate between authentication and authorization.
- What is two-factor authentication? Give an example.
Long answer
- Explain the three factors of authentication with their strengths and weaknesses.
- As an IT officer of a bank, what measures would you take to prevent unauthorized access?
