In this lesson,
we will be discussing information
regarding access control and permissions.
We will cover administrator and user accounts,
local accounts, Microsoft accounts,
and the importance of applying
the principle of least privilege.
Understanding how access control and permissions work
on a computer system is fundamental
to ensuring data security integrity.
Now let's imagine this.
You are the owner of a hotel
and you want to make sure that only the authorized people
who rented a room for the night
can enter that specific room.
So you issue a magnetic key card
to each person who checks in
and that card provides authorization for them
to access certain rooms
such as hotel rooms that they rented, the shared pool area,
and maybe even an executive lounge
if they're a platinum rewards member with your hotel chain.
Well, this same concept is used on our computer systems,
but instead of using a physical key card, we use usernames,
passwords, biometrics, and other access control techniques.
In the world of computers, the hotel is your system,
and the keys are the assigned user accounts
and their authentication mechanism.
Now, each user of the device is given a unique account.
They use their password
or another form of identification, like a fingerprint,
to prove they are rightfully the owner of that account,
similar to showing a key,
and this serves as the authentication to grant them access
to different parts of the system.
Now let's talk about privileges.
Just like each key card can access different rooms
in the hotel,
each user account has different levels
of access or privileges.
For example, the first account created
during the operating system setup is the most powerful one,
similar to the master key used by the housekeeping staff
at the hotel.
This account is called the local administrator account.
This local administrator account can be used
to change system settings, install applications,
and perform other managerial tasks.
But imagine if you gave a master key to every guest,
it would be chaotic and unsafe
because anyone could access any room in the hotel
that they wanted to access.
Well, the same concept applies for computers.
For everyday users,
we recreate standard user accounts instead to use.
These standard user accounts are like keys
that can only unlock certain doors.
Standard users can't change
the system configuration settings,
and they're restricted to saving files
within their designated user storage areas only,
similar to how a guest can only put their suitcase
inside their own rooms for storage at the hotel.
Now this brings us to a crucial security principle
known as the principle of least privilege.
The principle of least privilege means
that a user should only have the minimum access rights
needed to perform their job functions and tasks,
and nothing additional or extra.
So if you are a regular hotel guest,
you might get access to your room and the pool area
using your key card.
But if I'm a platinum rewards member,
I can get access to my room, the pool area,
and the executive lounge on the top floor with my key card.
This is the concept of least privilege in action
because as a platinum rewards member,
I need to be able to access the executive lounge,
but regular hotel guests don't get that level of access.
Another type of account most people are familiar with
is the Microsoft account,
which is a free online account that you can use
to sign into a variety of Microsoft services,
including Windows, Office 365, Xbox Live, and Skype.
Your Microsoft account is the type of online account
that allows us to access Microsoft services and apps
across multiple devices and can be used in place
of your Windows local user account
if you have the proper configuration settings in place.
Next, let's talk about a feature in Windows
known as user account control, or UAC,
that helps support the principle of least privilege.
User account control is a mechanism designed
to ensure that actions requiring administrative rights
are explicitly authorized by the user.
In our hotel example,
this might be like the housekeeper trying
to open your door to clean your room,
but before they're able to open the door,
they're asked a second time,
"Are you sure you want to open Jamario's room to clean it?"
If they enter a specific unlock code,
in addition to using their key card,
then the door would give them administrative rights
to open that door and perform the actions needed
for the job.
In this case, cleaning my room.
The real purpose of UAC is to minimize the risk posed
by malicious software gaining access
to administrative privileges,
and it does a good job of doing this.
Simply put, user account control
is like a security checkpoint and it pops up
when a task requires admin privileges,
like installing new software
or changing critical settings.
To proceed,
the user must either enter the administrator's password
or confirm the action by clicking Yes.
If you see a icon of a small shield
near options in a control panel or menus,
that indicates that action might prompt
a UAAC authorization dialogue.
Now, access control and permissions extend beyond
just individual users
and can also apply to groups of users.
In Windows, you'll find predefined user groups
like administrators and standard users.
When a user is added to a group,
they inherit the permissions of that group.
Similar to how being part
of the platinum rewards member program at a hotel
gives you access to the executive lounge facilities.
Now let's talk about file and folder permissions.
Just like you can control who enters a specific room,
you can also manage this who accesses
or modifies specific files and folders on your computer.
For example, you might want to give read access
to certain files to one user and write access to another.
You can set those permissions at the individual file level
or at the folder level.
Setting permissions at the folder level
applies those privileges to all files within that folder,
like declaring that all of the items
in a particular room can be used by a particular guest.
In Windows, these files and folder permissions are accessed
by right-clicking on a file or folder, selecting Properties,
and then navigating to the Security tab.
From there, you can edit the permissions
or different users in groups,
allowing them to read, write, execute,
or even take full control of files and folders.
But remember, discretion is key
when it comes to handling permissions.
Always ensure that you're only giving out
the necessary permissions to uphold
that very important principle of least privilege.
It's always better to err on the side of caution
when granting fewer permissions
than more permissions in order to keep your computer
and its data safe.
So to recap, access control and permissions
in computer systems are really important
to ensure data integrity.
We compared these concepts to hotel
where user accounts are like keys granting access
to specific parts of the system.
Authentication is another important concept,
and it simply means that we want to prove
that we have the right to use an account.
Privileges such as local administrator
and standard user account also help us achieve security
by emphasizing the principle of least privilege.
And lastly, always give less than necessary.
You'd rather have someone coming to you asking
for more privileges than less.