Theory: Identity, the AAA Framework & Authentication
Week 5 gave us the principle of Least Privilege: give each person only the access they need. This week puts it into practice. To decide exactly who can access what, a system must first know who you are and be sure you are really that person. This lesson covers the first two of the week’s five building blocks, Identity and Authentication, and introduces the AAA framework that organizes the rest of the week.
The Five Building Blocks
| # | Building block | Question it answers | Lesson |
|---|
| 1 | Identity | Who are you in the system? | 6.1 |
| 2 | Authentication | Can you prove that claim is true? | 6.1 |
| 3 | Authorization | What are you allowed to do? | 6.2 |
| 4 | Accounting | What did you actually do? (recorded) | 6.3 |
| 5 | Zero Trust | Do all three continuously, not just once | 6.3 |
What Is Identity?
Digital identity: the representation of a person (or a system) inside an IT system, for example a user account or an employee ID.
MediCare Plus example: employee ID “N-1042” belongs to nurse Somsri. That ID is her identity in the hospital’s systems.
But typing “N-1042” does not prove that the person at the keyboard is Somsri. Anyone can claim an identity. Proving it is a separate step.
Identity ≠ Authentication.
- Identity = who you claim to be (the username, the employee ID).
- Authentication = proof that the claim is true (the password, the badge, the fingerprint).
The Identity Lifecycle
An identity is not created once and forgotten. It must follow the person through their whole time with the organization:
Diagram loads as you scroll.
| Stage | What happens | MediCare Plus example | What goes wrong if it fails |
|---|
| Provisioning | Create the account when a person joins, with the access their role needs | HR submits a request, IT verifies the role, access is granted with least privilege, and the grant is logged | Staff share accounts while waiting, or get too much access “to be safe” |
| Change | Update role/department when it changes, removing access the new role does not need | A nurse moves from ICU to outpatients: ICU access should be removed, outpatient access added | Old access piles up; long-serving staff end up with far more access than any one role needs |
| Deprovisioning | Disable the account when the person leaves | A contractor’s account is disabled on the last day of the contract | The former employee or contractor can still log in after leaving |
The most common lifecycle failure is that a former employee’s or contractor’s account is never deprovisioned, so they (or anyone who obtains their password) can still log in after leaving. This is why MediCare Plus’s access control policy (Week 4) requires access to be revoked within 24 hours of any role or employment change, with quarterly access recertification to catch anything missed.
The AAA Framework
Once a claimed identity exists, security systems handle access in three steps, known as AAA:
Diagram loads as you scroll.
| A | Purpose | MediCare Plus example |
|---|
| Authentication | Prove who you are | Somsri enters her password and taps her badge |
| Authorization | Decide what you can do | The EHR lets the Nurse role view vitals and update charts, but not change pharmacy records |
| Accounting | Record what you did | The log notes that N-1042 opened patient X’s chart at 10:14 from ward workstation W-07 |
The order matters: the system cannot decide what you may do (authorization) until it trusts who you are (authentication), and the record (accounting) is only meaningful if it is tied to a proven identity.
Authentication vs. Authorization are the most commonly confused pair. Authentication answers “are you really who you say you are?”. Authorization answers “now that we know who you are, are you allowed to do this?”. A doctor who logs in successfully (authenticated) may still be refused a psychiatric record (not authorized).
Authentication Factors
A proof of identity comes from one of three factor categories:
| Factor | Meaning | Examples |
|---|
| Something you KNOW | A secret held in memory | Password, PIN, answer to a security question |
| Something you HAVE | A physical object in your possession | Hospital ID badge, phone with an authenticator app or token, smart card |
| Something you ARE | A physical (biometric) characteristic | Fingerprint, face, iris |
MediCare Plus example: a doctor logs in with a password (know) and taps a hospital ID badge (have), which is two different factors.
Multi-Factor Authentication (MFA)
Multi-Factor Authentication (MFA): combining two or more factors from different categories before granting access.
Factor 1 (e.g. password) + Factor 2 (e.g. phone token) = access granted.
Why it matters: a stolen password alone is no longer enough. An attacker who phishes a password must also steal the second factor, which is much harder, especially for something you have (it must be physically taken) or something you are.
Same category twice is not MFA. A password plus a PIN, or a password plus a security question, are both “something you know.” One phishing page can capture both. MFA needs factors from different categories.
Mini-example
A billing clerk at MediCare Plus types her password into a fake “insurance portal” page (as actually happened in the Week 2 case). With password-only login, the attacker can now log in from anywhere. With MFA (password + code from her phone), the attacker has the password but not her phone, so the login fails.
Worked Examples
Exercise 1
Classify each authentication method by factor category (Know / Have / Are), then decide whether each combination is true MFA.
- (a) Password + fingerprint
- (b) Password + PIN
- (c) Hospital badge + one-time code from a phone app
- (d) Smart card + PIN
Show solution ↓Hide solution ↑
Solution
Classify each component, then check whether the two components come from different categories.
| Factor 1 | Factor 2 | MFA? |
|---|
| (a) | Password = Know | Fingerprint = Are | Yes: two categories |
| (b) | Password = Know | PIN = Know | No: both are something you know |
| (c) | Badge = Have | Phone app code = Have (proves you hold the phone) | No: both are something you have |
| (d) | Smart card = Have | PIN = Know | Yes: two categories |
Final answer: (a) and (d) are MFA; (b) and (c) are not, because each uses one category twice. Note (c) is still stronger than a password alone, but by definition it is not multi-factor.
Exercise 2
For each MediCare Plus event, state whether it is an example of Identity, Authentication, Authorization, or Accounting.
- Pharmacist Anan is assigned the user ID “P-2207.”
- Anan scans his fingerprint at the pharmacy terminal.
- The pharmacy system lets Anan verify prescriptions but blocks him from editing EHR diagnoses.
- The system writes “P-2207 dispensed order #5521 at 14:32.”
Show solution ↓Hide solution ↑
Solution
- Identity: the user ID represents Anan inside the system; it is a claim, not yet proof.
- Authentication: the fingerprint (something you are) proves the claim.
- Authorization: the system decides what this proven identity may and may not do.
- Accounting: the system records what he did, when.
Exercise 3
Identify the identity-lifecycle stage that failed in each case and what should have happened.
- (a) A radiographer left MediCare Plus three months ago, but her account still works.
- (b) A nurse moved from the ICU to the outpatient clinic a year ago and can still open every ICU patient’s chart.
- (c) A new doctor waits two weeks for an account, so colleagues let her use theirs.
Show solution ↓Hide solution ↑
Solution
- (a) Deprovisioning failed. Her account should have been disabled when she left (MediCare Plus policy: within 24 hours of the employment change).
- (b) Change failed. When her department changed, the ICU access her new role does not need should have been removed, not just outpatient access added. Left alone, staff accumulate access well beyond least privilege.
- (c) Provisioning failed. The account should have been created when she joined, with her role’s access approved in advance. Slow provisioning pushes people into account sharing, which destroys accountability (the log shows the colleague, not her).
Exercise 4
A MediCare Plus manager says: “We don’t need MFA. Our passwords must be 12 characters long, so they can’t be guessed.” Explain why this reasoning is incomplete.
Show solution ↓Hide solution ↑
Solution
Step 1: what a long password protects against. Length makes guessing harder.
Step 2: what it does not protect against. Many real attacks don’t guess the password at all; they steal it. In the Week 2 case, a billing employee typed her credentials into a fake portal page. A 12-character password handed to a phishing page is just as useless as a 4-character one.
Step 3: what MFA adds. With MFA, the stolen password alone is not enough; the attacker also needs a factor from a different category (e.g. the employee’s phone or badge), which a phishing email cannot easily capture.
Final answer: password length defends against guessing, not theft; MFA ensures a stolen password alone cannot grant access. (Also note from Week 4: overly strict password rules often push people to write passwords on sticky notes.)
Exercise 5
Explain, using a MediCare Plus example, the difference between identity and authentication, and why a system needs both.
Show solution ↓Hide solution ↑
Solution
- Identity is who you claim to be: employee ID “N-1042” represents nurse Somsri in the hospital systems.
- Authentication is proof that the claim is true: Somsri’s password plus her badge tap.
Why both are needed: without identity, the system has nothing to attach permissions or logs to. Without authentication, anyone could type “N-1042” and act as Somsri, so all of Somsri’s permissions and every log entry in her name become meaningless. Identity says who; authentication makes that “who” trustworthy.