Authentication basics and protocols

Authentication is a process that identifies a person, device, or software process that's accessing data or information. Authorization is a process that grants access rights to perform actions on data or information.

There are three types of authentication mechanisms. These are what you know, what you have, and what you are:

• What you know: Usually user and password authentication
• What you have: Usually smart cards and card readers
• What you are: Biometrics such as fingerprint or eye retina scanning

There are several resources that we usually access:

• The organization networks. This is usually done with an SSL/TLS-VPN or IPSec VPN, which we will talk about later in this chapter.
• External web services (bank accounts, social networks, and so on). This is usually done with HTTPS, which uses SSL/TLS.
• Internal access to organization resources. This is provided by Microsoft or Linux mechanisms, and RADIUS/TACACS...