Building on the last lesson, let us look at the full journey of getting access — and the different ways to prove who you are.
What is it?
Access control is the overall system that decides who gets into what. It has three steps:
- Identification — you claim an identity (“I am user alice”).
- Authentication — you prove it (a password, a code, a fingerprint).
- Authorization — the system grants the access your identity is allowed.
Select any component in the diagram to read what it does.
Text description of this diagram
Access control decides, step by step, whether to let someone reach a resource.
Why is it important?
Access control is one of the most powerful protections there is. If only the right people can reach sensitive systems, most attacks never get started. It directly supports confidentiality from the CIA Triad.
How does it work?
Authentication can use three kinds of proof, called “factors”:
- Something you know — a password or PIN.
- Something you have — a phone, a security key, or a card.
- Something you are — a fingerprint or face scan (biometrics).
Using proof from two different kinds at once is called multi-factor authentication — the subject of a later lesson, and one of the best upgrades you can make.
A real-world example
Withdrawing cash from an ATM uses two factors: your bank card (something you have) and your PIN (something you know). A thief needs both. Stealing just the card, or just the PIN, is not enough — that is the strength of combining factors.
Check what you learned
What are the three steps of access control, in order?
Identification (claim an identity), authentication (prove it), authorization (receive the allowed access).
Name the three kinds of authentication factor.
Something you know, something you have, and something you are.
Key takeaways
- Access control runs identification, then authentication, then authorization.
- Authentication uses factors: something you know, have, or are.
- Strong access control stops most attacks before they start.