Computer Science · 10th Grade · Cybersecurity and Digital Defense · Weeks 28-36

Authentication and Authorization

Students learn about different authentication methods (passwords, biometrics, MFA) and authorization principles.

• Common Core State Standards
• CSTA: 3A-NI-06
• CSTA: 3A-NI-08

About This Topic

Authentication and authorization are two distinct but tightly related security concepts that students encounter daily without always naming them. Authentication answers the question 'Who are you?' while authorization answers 'What are you allowed to do?' A student who logs into their school Google account has authenticated; the fact that they can access their own Drive but not the teacher's gradebook is authorization. Understanding both concepts is essential to designing and evaluating any system that handles user data.

Authentication methods range from something you know (passwords, PINs) to something you have (a physical token or phone) to something you are (biometric data like a fingerprint or facial scan). Multi-factor authentication (MFA) combines at least two of these categories, making unauthorized access significantly harder even if one factor is compromised. Students examine the strengths and weaknesses of each method, including the trade-offs between security and usability.

These concepts align with CSTA standards 3A-NI-06 and 3A-NI-08. Comparative analysis activities work well here because students already have opinions about authentication from their own experience, giving them a starting point for more rigorous evaluation.

Key Questions

1. Compare the strengths and weaknesses of various authentication methods.
2. Explain the concept of multi-factor authentication (MFA).
3. Analyze how authorization controls access to resources.

Learning Objectives

• Compare the security strengths and usability trade-offs of password, biometric, and token-based authentication methods.
• Explain the principles of multi-factor authentication (MFA) and analyze scenarios where it is most effective.
• Analyze how role-based access control (RBAC) systems implement authorization to protect digital resources.
• Evaluate the potential vulnerabilities associated with common authentication and authorization practices.

Before You Start

Introduction to Cybersecurity

Why: Students need a foundational understanding of basic security threats and the importance of protecting digital information before exploring authentication and authorization.

User Accounts and Permissions

Why: Prior exposure to how operating systems manage user accounts and basic file permissions helps students grasp the concepts of identity verification and access control.

Key Vocabulary

Authentication	The process of verifying the identity of a user or device attempting to access a system or resource. It answers the question, 'Who are you?'
Authorization	The process of determining what actions a verified user or device is permitted to perform within a system. It answers the question, 'What are you allowed to do?'
Multi-Factor Authentication (MFA)	A security system that requires more than one method of verification to grant access, combining factors like something you know, something you have, or something you are.
Biometrics	Authentication methods that use unique biological characteristics, such as fingerprints, facial features, or iris patterns, to verify identity.
Role-Based Access Control (RBAC)	An authorization method that assigns permissions to users based on their assigned roles within an organization or system, simplifying access management.

Watch Out for These Misconceptions

Common Misconception

Authentication and authorization mean the same thing.

What to Teach Instead

Authentication verifies identity; authorization determines what an authenticated user can access. A person can be correctly authenticated and still be denied access to a specific resource because they lack authorization. Scenario-based activities that separate the two decisions make the distinction stick.

Common Misconception

Biometric authentication is more secure than passwords in all contexts.

What to Teach Instead

Biometrics are difficult to replicate but cannot be changed if compromised. A stolen password can be reset; a stolen fingerprint cannot. Biometrics also raise privacy concerns because they require storing sensitive physical data. Comparative analysis helps students evaluate context-dependent trade-offs rather than declaring a single winner.

Active Learning Ideas

Comparative Matrix: Authentication Method Trade-offs

Provide small groups with a table listing six authentication methods (password, PIN, SMS OTP, authenticator app, fingerprint, hardware key) and four evaluation criteria (security strength, cost, user friction, recovery if lost). Groups fill in the matrix and rank the methods for three specific use cases: a social media account, a hospital records system, and a personal phone.

40 min·Small Groups

Think-Pair-Share: Why Passwords Fail

Students individually list every reason a strong password policy might still fail in practice (reuse, phishing, database breaches, shoulder surfing). Pairs combine lists and categorize by human vs. technical causes. The class builds a shared catalog, then discusses which MFA factor addresses each failure mode.

25 min·Pairs

Design Challenge: Access Control for a School System

Small groups are given a scenario: design the authentication and authorization system for a K-12 school, with roles for students, teachers, counselors, and administrators. Each role has different data access needs. Groups must specify the authentication method and access permissions for each role, then present and defend their choices to the class.

50 min·Small Groups

Real-World Connections

• When logging into online banking, users often encounter MFA, requiring a password (something you know) and a code sent to their phone (something you have) to protect financial accounts.
• Cloud platforms like Amazon Web Services (AWS) use RBAC to manage developer and administrator access, ensuring engineers can only modify the specific services they are responsible for, preventing accidental data loss.
• Airport security systems use biometric scanners for frequent travelers, allowing for faster authentication by verifying unique physical traits like facial recognition or fingerprints.

Assessment Ideas

Exit Ticket

Provide students with three scenarios: 1) logging into a personal email, 2) a doctor accessing patient records, 3) a gamer accessing a private server. Ask them to identify the primary authentication method used in each and suggest one additional security measure (MFA or authorization principle) that should be applied and why.

Discussion Prompt

Pose the question: 'If a company has to choose between a highly secure but inconvenient authentication method and a less secure but very convenient one, how should they decide?' Facilitate a discussion where students debate the balance between security and usability, referencing specific authentication types.

Quick Check

Present students with a list of access permissions (e.g., 'read file', 'write file', 'delete file', 'administer system'). Ask them to assign these permissions to hypothetical roles like 'User', 'Editor', and 'Administrator', demonstrating their understanding of authorization principles.

Frequently Asked Questions

What is multi-factor authentication and why does it matter?

Multi-factor authentication requires users to verify identity using two or more categories: something you know, something you have, and something you are. Even if an attacker obtains a password, they still need the second factor to access the account. MFA is one of the highest-impact security controls available to individuals and organizations.

What is the principle of least privilege in authorization?

Least privilege means granting users only the minimum access rights needed to perform their job. This limits the damage a compromised account can cause: an attacker who gains access to a low-privilege account cannot access sensitive resources they were never authorized to reach. It is a foundational principle in secure system design.

Why do some systems still rely on passwords despite their weaknesses?

Passwords are inexpensive to implement, require no special hardware, and are universally understood. Despite known weaknesses like reuse and phishing vulnerability, their low cost and familiarity make them the default choice for many systems. The challenge is not replacing them but supplementing them with stronger controls like MFA.

How does active learning help students understand authentication concepts they already use daily?

Students interact with authentication systems dozens of times each day but rarely analyze the design decisions behind them. Structured comparison activities and design challenges prompt students to evaluate the systems they use with technical criteria, connecting abstract security principles to concrete personal experience.