Explain the role of authentication and authorisation in restricting access to a system, and identify common implementation methods including multi-factor authentication and role-based access control

What this dot point is asking

NESA wants you to clearly distinguish authentication (who you are) from authorisation (what you can do), and describe the standard implementations of each: passwords, multi-factor authentication, single sign-on, role-based access control, and the principle of least privilege.

The answer

Authentication: proving who you are

Authentication confirms a user's identity. It relies on one or more factors:

• Something you know: a password or PIN.
• Something you have: a phone (for SMS or authenticator app codes), a hardware security key (YubiKey), or a smart card.
• Something you are: a biometric like a fingerprint or face scan.

Single-factor authentication (just a password) is weak. Multi-factor authentication (MFA) combines two or more factor categories, dramatically reducing the success rate of credential-theft attacks.

Authorisation: deciding what you can do

Once a user is authenticated, authorisation governs which actions they can perform and which resources they can access. The two dominant models:

• Role-based access control (RBAC). Users are assigned roles; roles have permission sets. Easy to administer at scale. Used in most SaaS apps.
• Attribute-based access control (ABAC). Permissions are computed from user attributes, resource attributes, and environmental context (time of day, IP address). More flexible, more complex.

Least privilege

Whichever model is used, the principle of least privilege says give each user only the permissions strictly needed for their role. A junior support agent does not need access to billing data. A read-only auditor never needs write permissions.

Implementation in Python (Flask)

from flask import Flask, request, abort
from functools import wraps

ROLES = {
    "alice": "admin",
    "bob": "auditor",
    "carol": "support",
}

PERMISSIONS = {
    "admin": {"view", "edit", "delete"},
    "auditor": {"view"},
    "support": {"view", "edit"},
}

def authenticate(username, password):
    # ... verify credentials against hashed password store ...
    return ROLES.get(username)

def require_permission(perm):
    def decorator(f):
        @wraps(f)
        def wrapper(*args, **kwargs):
            role = request.headers.get("X-Role")
            if perm not in PERMISSIONS.get(role, set()):
                abort(403)
            return f(*args, **kwargs)
        return wrapper
    return decorator

@app.route("/users/<id>", methods=["DELETE"])
@require_permission("delete")
def delete_user(id):
    # ... delete logic ...
    return "", 204

The authenticate function checks identity. The require_permission decorator checks authorisation. Separating the two is the standard pattern.