In this lesson,
we're going to cover authorization.
Authorization in cybersecurity pertains to the permissions
and privileges that are granted to users or entities
after they've been authenticated.
While authentication is all about verifying the identity,
authorization is all about determining
what that identity is allowed to do within a given system.
Think of it as the difference
between entering a secure building with an access card,
which is your way of being authenticated,
and being allowed to enter a specific room
or floor within that building,
which is where you're being authorized to enter.
This concept of who is allowed inside and who is kept out
has been an integral part
of societal structures for centuries.
For example, in today's digital world,
almost everyone has the right permissions
to access a social media platform,
where only a few select users,
like system administrators or content moderators,
have the rights to access the backend systems
or the underlying user data.
This selective access ensures that only those
with the necessary permissions can enter the more sensitive
or restricted portions of that website or platform.
So, while many users might have access
to a given system or application,
their roles within that system
will be determining the actions that they can perform,
the data they can view or modify,
and the areas they can access.
Now, authorization mechanisms range from role-based
to rule-based to attribute-based controls
in order to determine
what permissions each user's going to be given.
Authorization mechanisms are important
for us to protect our sensitive data,
to maintain our system integrity,
and to streamline the user experience too.
First, let's talk about authorization
in order to protect our sensitive data.
By controlling who can access what,
authorization ensures that sensitive or confidential data
is accessible only to those with the proper clearance.
Let's consider a network used by a hospital system.
While a nurse might have access to the patient's vitals,
only specific doctors or specialists might be authorized
to alter treatment plans or prescribe medication
using that system.
As a patient, we may only be allowed
to view some of the information from our records,
but we may be prevented
from reading the doctor's personal notes
in our medical records as well
because we're not authorized to do that.
Second, we use authorization
to maintain the system integrity
inside of our organizations.
Authorization can help prevent accidental
or deliberate system misconfigurations or data alterations
by only providing the ability to change those things
to well-trained and experienced system administrators.
For example, at my company,
several of us are able to view financial reports
for the company,
but only a few people,
like our accountants or financial officers,
are authorized to input any transactions
or to make changes to the existing data
in our accounting software.
Third, and finally, we use authorization
to create more streamlined user experiences.
By providing users with only the options
and data relevant to their role,
systems can offer a more streamlined
and user-friendly experience.
For example, since you're a student in this course,
you can see the course drastically differently
than I do as an instructor.
This is because I have additional access rights
that you simply don't have,
like the ability to upload new videos,
edit the quiz questions,
add new practice exam questions, and things like that.
On the other hand, since you're a student,
you can take those quizzes and practice exams
using an interactive environment
that I, as the instructor, simply don't have access to.
So remember, when you think about authorization,
I want you to envision it as a set of rules and policies
that are used to dictate what actions users or entities
can perform once their identity is verified.
It's the system's way of saying,
"Now that I know who you are,
here's what you're allowed to do."
In a digital environment where data protection
and system integrity are paramount,
authorization is going to serve as our gatekeeper
to ensure that the right people have the right access
for the right things.