Access Control and Data Protection
Authentication and access control
Authentication proves identity via three factor types: something you know (password, PIN), something you have (token, phone, smart card), and something you are (fingerprint, face). Multi-factor authentication (MFA) combines different types - a password plus a one-time code is true MFA; two passwords are not. Authorisation decides what an authenticated user may do. Access models include role-based access control (RBAC) and attribute-based rules, guided by least privilege and need-to-know.
Passwords and accounts
Strong passwords are long, unique, and unpredictable; use a password manager rather than reuse. Account lockout after failed attempts slows brute-force guessing. Biometrics are convenient but cannot be reset if compromised. Disable or delete unused accounts promptly - dormant accounts are a common audit finding.
Protecting data
Encryption at rest protects stored data (full-disk, file, or database encryption). Hashing is one-way and verifies integrity, not confidentiality - do not confuse it with encryption. Backups must be regular, tested, and ideally kept offline or offsite against ransomware. Data classification (public, internal, confidential, secret) drives handling rules. Anonymisation and pseudonymisation reduce personal-data exposure.
Legal and traps
Know the ideas behind data-protection law: lawful basis, purpose limitation, data minimisation, retention limits, and individual rights (access, correction, erasure). Traps include treating hashing as encryption, believing MFA means "two passwords", and assuming deleting a file removes it everywhere.
Worked example: A shared admin account used by five staff violates accountability and least privilege. Correct approach: individual named accounts, RBAC roles, MFA for privileged access, and logging.