1
00:00:00,000 --> 00:00:00,930
In this lesson,

2
00:00:00,930 --> 00:00:03,060
we're going to cover authorization.

3
00:00:03,060 --> 00:00:05,700
Authorization in cybersecurity pertains to the permissions

4
00:00:05,700 --> 00:00:08,340
and privileges that are granted to users or entities

5
00:00:08,340 --> 00:00:10,200
after they've been authenticated.

6
00:00:10,200 --> 00:00:13,200
While authentication is all about verifying the identity,

7
00:00:13,200 --> 00:00:15,090
authorization is all about determining

8
00:00:15,090 --> 00:00:18,330
what that identity is allowed to do within a given system.

9
00:00:18,330 --> 00:00:19,163
Think of it as the difference

10
00:00:19,163 --> 00:00:21,420
between entering a secure building with an access card,

11
00:00:21,420 --> 00:00:23,250
which is your way of being authenticated,

12
00:00:23,250 --> 00:00:24,960
and being allowed to enter a specific room

13
00:00:24,960 --> 00:00:26,490
or floor within that building,

14
00:00:26,490 --> 00:00:28,950
which is where you're being authorized to enter.

15
00:00:28,950 --> 00:00:31,920
This concept of who is allowed inside and who is kept out

16
00:00:31,920 --> 00:00:32,753
has been an integral part

17
00:00:32,753 --> 00:00:35,160
of societal structures for centuries.

18
00:00:35,160 --> 00:00:37,110
For example, in today's digital world,

19
00:00:37,110 --> 00:00:38,730
almost everyone has the right permissions

20
00:00:38,730 --> 00:00:40,800
to access a social media platform,

21
00:00:40,800 --> 00:00:42,120
where only a few select users,

22
00:00:42,120 --> 00:00:44,370
like system administrators or content moderators,

23
00:00:44,370 --> 00:00:46,350
have the rights to access the backend systems

24
00:00:46,350 --> 00:00:48,270
or the underlying user data.

25
00:00:48,270 --> 00:00:50,064
This selective access ensures that only those

26
00:00:50,064 --> 00:00:52,770
with the necessary permissions can enter the more sensitive

27
00:00:52,770 --> 00:00:56,130
or restricted portions of that website or platform.

28
00:00:56,130 --> 00:00:57,840
So, while many users might have access

29
00:00:57,840 --> 00:00:59,550
to a given system or application,

30
00:00:59,550 --> 00:01:00,881
their roles within that system

31
00:01:00,881 --> 00:01:03,750
will be determining the actions that they can perform,

32
00:01:03,750 --> 00:01:05,340
the data they can view or modify,

33
00:01:05,340 --> 00:01:07,590
and the areas they can access.

34
00:01:07,590 --> 00:01:10,170
Now, authorization mechanisms range from role-based

35
00:01:10,170 --> 00:01:12,480
to rule-based to attribute-based controls

36
00:01:12,480 --> 00:01:13,380
in order to determine

37
00:01:13,380 --> 00:01:15,780
what permissions each user's going to be given.

38
00:01:15,780 --> 00:01:17,670
Authorization mechanisms are important

39
00:01:17,670 --> 00:01:19,560
for us to protect our sensitive data,

40
00:01:19,560 --> 00:01:20,880
to maintain our system integrity,

41
00:01:20,880 --> 00:01:23,370
and to streamline the user experience too.

42
00:01:23,370 --> 00:01:25,065
First, let's talk about authorization

43
00:01:25,065 --> 00:01:27,480
in order to protect our sensitive data.

44
00:01:27,480 --> 00:01:29,310
By controlling who can access what,

45
00:01:29,310 --> 00:01:32,250
authorization ensures that sensitive or confidential data

46
00:01:32,250 --> 00:01:34,890
is accessible only to those with the proper clearance.

47
00:01:34,890 --> 00:01:37,380
Let's consider a network used by a hospital system.

48
00:01:37,380 --> 00:01:39,960
While a nurse might have access to the patient's vitals,

49
00:01:39,960 --> 00:01:42,411
only specific doctors or specialists might be authorized

50
00:01:42,411 --> 00:01:44,970
to alter treatment plans or prescribe medication

51
00:01:44,970 --> 00:01:46,380
using that system.

52
00:01:46,380 --> 00:01:48,180
As a patient, we may only be allowed

53
00:01:48,180 --> 00:01:50,310
to view some of the information from our records,

54
00:01:50,310 --> 00:01:51,150
but we may be prevented

55
00:01:51,150 --> 00:01:52,464
from reading the doctor's personal notes

56
00:01:52,464 --> 00:01:54,300
in our medical records as well

57
00:01:54,300 --> 00:01:56,550
because we're not authorized to do that.

58
00:01:56,550 --> 00:01:58,350
Second, we use authorization

59
00:01:58,350 --> 00:01:59,700
to maintain the system integrity

60
00:01:59,700 --> 00:02:01,530
inside of our organizations.

61
00:02:01,530 --> 00:02:03,286
Authorization can help prevent accidental

62
00:02:03,286 --> 00:02:06,510
or deliberate system misconfigurations or data alterations

63
00:02:06,510 --> 00:02:08,910
by only providing the ability to change those things

64
00:02:08,910 --> 00:02:11,910
to well-trained and experienced system administrators.

65
00:02:11,910 --> 00:02:13,590
For example, at my company,

66
00:02:13,590 --> 00:02:15,630
several of us are able to view financial reports

67
00:02:15,630 --> 00:02:16,463
for the company,

68
00:02:16,463 --> 00:02:17,310
but only a few people,

69
00:02:17,310 --> 00:02:19,320
like our accountants or financial officers,

70
00:02:19,320 --> 00:02:21,270
are authorized to input any transactions

71
00:02:21,270 --> 00:02:23,151
or to make changes to the existing data

72
00:02:23,151 --> 00:02:25,260
in our accounting software.

73
00:02:25,260 --> 00:02:26,935
Third, and finally, we use authorization

74
00:02:26,935 --> 00:02:29,790
to create more streamlined user experiences.

75
00:02:29,790 --> 00:02:31,175
By providing users with only the options

76
00:02:31,175 --> 00:02:33,060
and data relevant to their role,

77
00:02:33,060 --> 00:02:34,213
systems can offer a more streamlined

78
00:02:34,213 --> 00:02:36,240
and user-friendly experience.

79
00:02:36,240 --> 00:02:38,460
For example, since you're a student in this course,

80
00:02:38,460 --> 00:02:40,470
you can see the course drastically differently

81
00:02:40,470 --> 00:02:42,300
than I do as an instructor.

82
00:02:42,300 --> 00:02:43,950
This is because I have additional access rights

83
00:02:43,950 --> 00:02:45,300
that you simply don't have,

84
00:02:45,300 --> 00:02:47,100
like the ability to upload new videos,

85
00:02:47,100 --> 00:02:47,981
edit the quiz questions,

86
00:02:47,981 --> 00:02:51,180
add new practice exam questions, and things like that.

87
00:02:51,180 --> 00:02:53,010
On the other hand, since you're a student,

88
00:02:53,010 --> 00:02:54,930
you can take those quizzes and practice exams

89
00:02:54,930 --> 00:02:56,310
using an interactive environment

90
00:02:56,310 --> 00:02:59,640
that I, as the instructor, simply don't have access to.

91
00:02:59,640 --> 00:03:02,010
So remember, when you think about authorization,

92
00:03:02,010 --> 00:03:04,680
I want you to envision it as a set of rules and policies

93
00:03:04,680 --> 00:03:07,170
that are used to dictate what actions users or entities

94
00:03:07,170 --> 00:03:09,810
can perform once their identity is verified.

95
00:03:09,810 --> 00:03:11,167
It's the system's way of saying,

96
00:03:11,167 --> 00:03:12,630
"Now that I know who you are,

97
00:03:12,630 --> 00:03:14,160
here's what you're allowed to do."

98
00:03:14,160 --> 00:03:16,110
In a digital environment where data protection

99
00:03:16,110 --> 00:03:18,000
and system integrity are paramount,

100
00:03:18,000 --> 00:03:19,954
authorization is going to serve as our gatekeeper

101
00:03:19,954 --> 00:03:22,680
to ensure that the right people have the right access

102
00:03:22,680 --> 00:03:24,063
for the right things.