1 00:00:00,000 --> 00:00:00,900 In this lesson, 2 00:00:00,900 --> 00:00:02,400 we will be discussing information 3 00:00:02,400 --> 00:00:04,620 regarding access control and permissions. 4 00:00:04,620 --> 00:00:06,930 We will cover administrator and user accounts, 5 00:00:06,930 --> 00:00:09,120 local accounts, Microsoft accounts, 6 00:00:09,120 --> 00:00:10,470 and the importance of applying 7 00:00:10,470 --> 00:00:12,600 the principle of least privilege. 8 00:00:12,600 --> 00:00:14,850 Understanding how access control and permissions work 9 00:00:14,850 --> 00:00:16,800 on a computer system is fundamental 10 00:00:16,800 --> 00:00:19,020 to ensuring data security integrity. 11 00:00:19,020 --> 00:00:20,940 Now let's imagine this. 12 00:00:20,940 --> 00:00:22,710 You are the owner of a hotel 13 00:00:22,710 --> 00:00:25,800 and you want to make sure that only the authorized people 14 00:00:25,800 --> 00:00:27,330 who rented a room for the night 15 00:00:27,330 --> 00:00:29,430 can enter that specific room. 16 00:00:29,430 --> 00:00:31,890 So you issue a magnetic key card 17 00:00:31,890 --> 00:00:33,720 to each person who checks in 18 00:00:33,720 --> 00:00:35,760 and that card provides authorization for them 19 00:00:35,760 --> 00:00:37,290 to access certain rooms 20 00:00:37,290 --> 00:00:40,620 such as hotel rooms that they rented, the shared pool area, 21 00:00:40,620 --> 00:00:42,600 and maybe even an executive lounge 22 00:00:42,600 --> 00:00:46,140 if they're a platinum rewards member with your hotel chain. 23 00:00:46,140 --> 00:00:49,770 Well, this same concept is used on our computer systems, 24 00:00:49,770 --> 00:00:53,310 but instead of using a physical key card, we use usernames, 25 00:00:53,310 --> 00:00:57,450 passwords, biometrics, and other access control techniques. 26 00:00:57,450 --> 00:00:59,970 In the world of computers, the hotel is your system, 27 00:00:59,970 --> 00:01:02,670 and the keys are the assigned user accounts 28 00:01:02,670 --> 00:01:05,310 and their authentication mechanism. 29 00:01:05,310 --> 00:01:09,510 Now, each user of the device is given a unique account. 30 00:01:09,510 --> 00:01:10,740 They use their password 31 00:01:10,740 --> 00:01:13,620 or another form of identification, like a fingerprint, 32 00:01:13,620 --> 00:01:16,770 to prove they are rightfully the owner of that account, 33 00:01:16,770 --> 00:01:18,810 similar to showing a key, 34 00:01:18,810 --> 00:01:21,680 and this serves as the authentication to grant them access 35 00:01:21,680 --> 00:01:23,790 to different parts of the system. 36 00:01:23,790 --> 00:01:26,220 Now let's talk about privileges. 37 00:01:26,220 --> 00:01:28,890 Just like each key card can access different rooms 38 00:01:28,890 --> 00:01:29,940 in the hotel, 39 00:01:29,940 --> 00:01:31,860 each user account has different levels 40 00:01:31,860 --> 00:01:33,870 of access or privileges. 41 00:01:33,870 --> 00:01:36,270 For example, the first account created 42 00:01:36,270 --> 00:01:39,480 during the operating system setup is the most powerful one, 43 00:01:39,480 --> 00:01:42,630 similar to the master key used by the housekeeping staff 44 00:01:42,630 --> 00:01:43,680 at the hotel. 45 00:01:43,680 --> 00:01:47,220 This account is called the local administrator account. 46 00:01:47,220 --> 00:01:49,680 This local administrator account can be used 47 00:01:49,680 --> 00:01:52,500 to change system settings, install applications, 48 00:01:52,500 --> 00:01:55,470 and perform other managerial tasks. 49 00:01:55,470 --> 00:01:58,830 But imagine if you gave a master key to every guest, 50 00:01:58,830 --> 00:02:00,540 it would be chaotic and unsafe 51 00:02:00,540 --> 00:02:03,210 because anyone could access any room in the hotel 52 00:02:03,210 --> 00:02:04,800 that they wanted to access. 53 00:02:04,800 --> 00:02:07,410 Well, the same concept applies for computers. 54 00:02:07,410 --> 00:02:08,243 For everyday users, 55 00:02:08,243 --> 00:02:11,940 we recreate standard user accounts instead to use. 56 00:02:11,940 --> 00:02:14,250 These standard user accounts are like keys 57 00:02:14,250 --> 00:02:16,530 that can only unlock certain doors. 58 00:02:16,530 --> 00:02:18,150 Standard users can't change 59 00:02:18,150 --> 00:02:19,920 the system configuration settings, 60 00:02:19,920 --> 00:02:21,630 and they're restricted to saving files 61 00:02:21,630 --> 00:02:24,660 within their designated user storage areas only, 62 00:02:24,660 --> 00:02:27,060 similar to how a guest can only put their suitcase 63 00:02:27,060 --> 00:02:29,730 inside their own rooms for storage at the hotel. 64 00:02:29,730 --> 00:02:32,610 Now this brings us to a crucial security principle 65 00:02:32,610 --> 00:02:34,860 known as the principle of least privilege. 66 00:02:34,860 --> 00:02:36,780 The principle of least privilege means 67 00:02:36,780 --> 00:02:40,140 that a user should only have the minimum access rights 68 00:02:40,140 --> 00:02:42,780 needed to perform their job functions and tasks, 69 00:02:42,780 --> 00:02:45,000 and nothing additional or extra. 70 00:02:45,000 --> 00:02:47,580 So if you are a regular hotel guest, 71 00:02:47,580 --> 00:02:50,280 you might get access to your room and the pool area 72 00:02:50,280 --> 00:02:51,660 using your key card. 73 00:02:51,660 --> 00:02:53,640 But if I'm a platinum rewards member, 74 00:02:53,640 --> 00:02:56,340 I can get access to my room, the pool area, 75 00:02:56,340 --> 00:03:00,030 and the executive lounge on the top floor with my key card. 76 00:03:00,030 --> 00:03:02,190 This is the concept of least privilege in action 77 00:03:02,190 --> 00:03:04,560 because as a platinum rewards member, 78 00:03:04,560 --> 00:03:07,080 I need to be able to access the executive lounge, 79 00:03:07,080 --> 00:03:11,160 but regular hotel guests don't get that level of access. 80 00:03:11,160 --> 00:03:13,860 Another type of account most people are familiar with 81 00:03:13,860 --> 00:03:15,390 is the Microsoft account, 82 00:03:15,390 --> 00:03:17,580 which is a free online account that you can use 83 00:03:17,580 --> 00:03:20,190 to sign into a variety of Microsoft services, 84 00:03:20,190 --> 00:03:25,190 including Windows, Office 365, Xbox Live, and Skype. 85 00:03:25,620 --> 00:03:28,200 Your Microsoft account is the type of online account 86 00:03:28,200 --> 00:03:31,410 that allows us to access Microsoft services and apps 87 00:03:31,410 --> 00:03:34,440 across multiple devices and can be used in place 88 00:03:34,440 --> 00:03:36,360 of your Windows local user account 89 00:03:36,360 --> 00:03:39,480 if you have the proper configuration settings in place. 90 00:03:39,480 --> 00:03:41,940 Next, let's talk about a feature in Windows 91 00:03:41,940 --> 00:03:45,180 known as user account control, or UAC, 92 00:03:45,180 --> 00:03:48,090 that helps support the principle of least privilege. 93 00:03:48,090 --> 00:03:50,760 User account control is a mechanism designed 94 00:03:50,760 --> 00:03:54,060 to ensure that actions requiring administrative rights 95 00:03:54,060 --> 00:03:56,820 are explicitly authorized by the user. 96 00:03:56,820 --> 00:03:58,140 In our hotel example, 97 00:03:58,140 --> 00:04:00,030 this might be like the housekeeper trying 98 00:04:00,030 --> 00:04:02,220 to open your door to clean your room, 99 00:04:02,220 --> 00:04:04,740 but before they're able to open the door, 100 00:04:04,740 --> 00:04:06,127 they're asked a second time, 101 00:04:06,127 --> 00:04:09,690 "Are you sure you want to open Jamario's room to clean it?" 102 00:04:09,690 --> 00:04:11,790 If they enter a specific unlock code, 103 00:04:11,790 --> 00:04:13,710 in addition to using their key card, 104 00:04:13,710 --> 00:04:15,840 then the door would give them administrative rights 105 00:04:15,840 --> 00:04:18,690 to open that door and perform the actions needed 106 00:04:18,690 --> 00:04:19,589 for the job. 107 00:04:19,589 --> 00:04:21,600 In this case, cleaning my room. 108 00:04:21,600 --> 00:04:24,900 The real purpose of UAC is to minimize the risk posed 109 00:04:24,900 --> 00:04:26,730 by malicious software gaining access 110 00:04:26,730 --> 00:04:28,260 to administrative privileges, 111 00:04:28,260 --> 00:04:30,720 and it does a good job of doing this. 112 00:04:30,720 --> 00:04:32,970 Simply put, user account control 113 00:04:32,970 --> 00:04:35,430 is like a security checkpoint and it pops up 114 00:04:35,430 --> 00:04:37,710 when a task requires admin privileges, 115 00:04:37,710 --> 00:04:39,000 like installing new software 116 00:04:39,000 --> 00:04:40,770 or changing critical settings. 117 00:04:40,770 --> 00:04:41,603 To proceed, 118 00:04:41,603 --> 00:04:44,190 the user must either enter the administrator's password 119 00:04:44,190 --> 00:04:46,620 or confirm the action by clicking Yes. 120 00:04:46,620 --> 00:04:48,660 If you see a icon of a small shield 121 00:04:48,660 --> 00:04:50,850 near options in a control panel or menus, 122 00:04:50,850 --> 00:04:52,800 that indicates that action might prompt 123 00:04:52,800 --> 00:04:55,260 a UAAC authorization dialogue. 124 00:04:55,260 --> 00:04:58,290 Now, access control and permissions extend beyond 125 00:04:58,290 --> 00:04:59,850 just individual users 126 00:04:59,850 --> 00:05:02,310 and can also apply to groups of users. 127 00:05:02,310 --> 00:05:05,220 In Windows, you'll find predefined user groups 128 00:05:05,220 --> 00:05:07,800 like administrators and standard users. 129 00:05:07,800 --> 00:05:09,300 When a user is added to a group, 130 00:05:09,300 --> 00:05:11,310 they inherit the permissions of that group. 131 00:05:11,310 --> 00:05:12,420 Similar to how being part 132 00:05:12,420 --> 00:05:15,420 of the platinum rewards member program at a hotel 133 00:05:15,420 --> 00:05:18,660 gives you access to the executive lounge facilities. 134 00:05:18,660 --> 00:05:21,480 Now let's talk about file and folder permissions. 135 00:05:21,480 --> 00:05:24,270 Just like you can control who enters a specific room, 136 00:05:24,270 --> 00:05:26,490 you can also manage this who accesses 137 00:05:26,490 --> 00:05:29,910 or modifies specific files and folders on your computer. 138 00:05:29,910 --> 00:05:32,490 For example, you might want to give read access 139 00:05:32,490 --> 00:05:36,270 to certain files to one user and write access to another. 140 00:05:36,270 --> 00:05:39,450 You can set those permissions at the individual file level 141 00:05:39,450 --> 00:05:41,010 or at the folder level. 142 00:05:41,010 --> 00:05:42,960 Setting permissions at the folder level 143 00:05:42,960 --> 00:05:46,020 applies those privileges to all files within that folder, 144 00:05:46,020 --> 00:05:47,760 like declaring that all of the items 145 00:05:47,760 --> 00:05:50,520 in a particular room can be used by a particular guest. 146 00:05:50,520 --> 00:05:53,250 In Windows, these files and folder permissions are accessed 147 00:05:53,250 --> 00:05:56,250 by right-clicking on a file or folder, selecting Properties, 148 00:05:56,250 --> 00:05:58,590 and then navigating to the Security tab. 149 00:05:58,590 --> 00:06:00,450 From there, you can edit the permissions 150 00:06:00,450 --> 00:06:02,040 or different users in groups, 151 00:06:02,040 --> 00:06:04,530 allowing them to read, write, execute, 152 00:06:04,530 --> 00:06:07,140 or even take full control of files and folders. 153 00:06:07,140 --> 00:06:08,940 But remember, discretion is key 154 00:06:08,940 --> 00:06:10,890 when it comes to handling permissions. 155 00:06:10,890 --> 00:06:13,050 Always ensure that you're only giving out 156 00:06:13,050 --> 00:06:14,790 the necessary permissions to uphold 157 00:06:14,790 --> 00:06:17,130 that very important principle of least privilege. 158 00:06:17,130 --> 00:06:20,010 It's always better to err on the side of caution 159 00:06:20,010 --> 00:06:21,690 when granting fewer permissions 160 00:06:21,690 --> 00:06:23,970 than more permissions in order to keep your computer 161 00:06:23,970 --> 00:06:25,650 and its data safe. 162 00:06:25,650 --> 00:06:28,170 So to recap, access control and permissions 163 00:06:28,170 --> 00:06:30,120 in computer systems are really important 164 00:06:30,120 --> 00:06:31,710 to ensure data integrity. 165 00:06:31,710 --> 00:06:33,600 We compared these concepts to hotel 166 00:06:33,600 --> 00:06:36,120 where user accounts are like keys granting access 167 00:06:36,120 --> 00:06:37,950 to specific parts of the system. 168 00:06:37,950 --> 00:06:40,530 Authentication is another important concept, 169 00:06:40,530 --> 00:06:42,270 and it simply means that we want to prove 170 00:06:42,270 --> 00:06:44,880 that we have the right to use an account. 171 00:06:44,880 --> 00:06:46,770 Privileges such as local administrator 172 00:06:46,770 --> 00:06:49,590 and standard user account also help us achieve security 173 00:06:49,590 --> 00:06:51,960 by emphasizing the principle of least privilege. 174 00:06:51,960 --> 00:06:55,140 And lastly, always give less than necessary. 175 00:06:55,140 --> 00:06:56,520 You'd rather have someone coming to you asking 176 00:06:56,520 --> 00:06:58,353 for more privileges than less.