Access control has two parts. Authentication proves who you are (a password, and with multi-factor sign-in a code from your phone too). Authorisation (permissions) then decides what you may do. Give each role only what its job needs: least privilege.
You and your teacher both sign in to the same school system. Why can your teacher change marks and you can't?
On a shared system (a school portal, a company network), access control decides who gets in and what they may do. It has two separate parts:
Authentication: proving who you are. Usually a password; with multi-factor sign-in, also something you have, such as a code on your phone.
Authorisation: what you may do once the system knows who you are, set by permissions.
Predict: Read the problem and decide what you think before you try anything. A wrong guess is fine: it shows you what to look for.
Try: Try it on the board and compare the result with your prediction.
Investigate: Work out why it happens, one step at a time.
Modify: Change the problem on purpose and see what happens.
Practise: A few on your own, to check you have it.
Make: Make your own problem using what you have learned. Expect a few tries; that is normal.
Make your prediction first. Help opens once you've locked it in.
PredictRead the problem and decide what you think before you try anything. A wrong guess is fine: it shows you what to look for.
Signed in, but…
TryTry it on the board and compare the result with your prediction.
Try: sign in and try
Was your prediction right? Now sign in as Ms Lee and try the same.
Try it yourselfYour edits are saved in this browser.
Sign in as Sam (password maple) and try to change Marks. Then read Marks.
Use the board. This ticks when you get there.
InvestigateWork out why it happens, one step at a time.
Worked example: two checks
Worked exampleBefore each step, say what you think comes next.
Sam types "maple"Authentication: is the password right for Sam?
signed in as Sam (student)The system now knows who is asking.
"change Marks"Authorisation: what may students do with Marks?
Students: Marks = readThe permissions table says read only.
deniedSigned in, but not allowed. Least privilege: each role gets only what its job needs.
Now name the authentication step.
Sam explains what signing in allows. Click the line where it first goes wrong.
ModifyChange the problem on purpose and see what happens.
Vary: one change at a time
Try it yourselfYour edits are saved in this browser.
Sign in as Ms Lee (password orbit) and change Marks.
Use the board. This ticks when you get there.
Sign out, then try to sign in as Ms Lee with a wrong password, and change Marks.
Use the board. This ticks when you get there.
Turn on multi-factor sign-in and sign in as Ms Lee with her password and the code 4096.
Use the board. This ticks when you get there.
PractiseA few on your own, to check you have it.
Access control
Authentication (who are you?) or authorisation (what may you do?)
Typing a password
A fingerprint unlock
A code from an app on your phone
Students may read but not change Marks
Only the class teacher can open the gradebook
A shared folder set to view only
MakeMake your own problem using what you have learned. Expect a few tries; that is normal.
Least privilege
Then: which account would an attacker most want to steal, and how would you protect it?
Try it yourselfYour edits are saved in this browser.
Need a hint?
Students: change their homework, read their marks, no settings.
Another hint
Teachers: change homework and marks, no settings.
Another hint
Admins: read homework and marks, change settings.
This table gives everyone too much. Click cells to set least privilege: students change Homework, read Marks, nothing in Settings; teachers change Homework and Marks, nothing in Settings; admins read Homework and Marks, change Settings.
Use the board. This ticks when you get there.
For teachers
Students sign in as different users, try to read and change files, switch on multi-factor sign-in and fix a permissions table, to distinguish authentication from authorisation and apply least privilege (AC9TDI10K01 node 3). About 40 minutes.
I can explain the difference between authentication and authorisation.
I can explain why multi-factor sign-in is safer.
I can set permissions so each role has only what it needs.
Before class
Try the board yourself. The practice accounts are on the board (Sam: maple, Ms Lee: orbit, Admin: quartz-river-71; MFA code 4096); they are made up and only work here.
The one idea (the kit's typical width): authentication proves identity, authorisation decides actions; both are needed on a shared system. Least privilege limits the damage from a stolen or misused account.
Real-world link: the school's own systems (who can see what in the learning management system); avoid showing real accounts.
Running the lesson
Predict: students who chose "it works" hold Sam's misconception.
Try: ask what was checked first, and what second.
Worked example: map each line to authentication or authorisation.
Vary: ask what an attacker would need with MFA on.
Make: ask why admins don't get to change marks.
The hard part (on purpose)
Students treat "signed in" as "allowed". Keep asking two questions in order: who are you? what may you do?
When students get stuck
A student says Sam can do anything once signed in (Sam's mistake). Ask: What did the password prove? What decides the rest? Fix: Signing in proves who; permissions decide what.
A student gives every role everything to make it work. Ask: What does each job actually need? Fix: Least privilege: only that.
Stretch and support
Stretch: Some systems use roles (teacher, student) and some give permissions to each person. What are the trade-offs for a school?
Support: Two questions on the board: Who are you? (authentication) What may you do? (authorisation).
Where it leads
Next: Hashes and keys (how passwords are stored and secrets shared).
Links: Secret messages' challenge and response is another way to prove who you are.
What each step is for
signed in, but…: Committing to whether a signed-in student can change marks tests the new move: authentication and authorisation are separate checks.
Try: sign in and try: Signing in as Sam and trying to change Marks settles the prediction: signed in, yet denied.
Worked example: two checks: Following one request through both checks models the new move, plus why least privilege matters. Sam treats signing in as permission to do anything, the misconception planted after the method.
Vary: one change at a time: Each task changes one thing: a different user, a wrong password, multi-factor sign-in, then the admin's role.
access control: Sorting examples into authentication and authorisation, judging passwords and permissions, and a review of DNS.
least privilege: Fixing a permissions table so every role has exactly what its job needs reverses the process: students start from the jobs and set the permissions.
Now you can
Explain the difference between authentication and authorisation.
Explain why multi-factor sign-in is safer.
Set permissions so each role has only what it needs.