Access Control (Authorise vs Authenticate)

"Mr Smith? Yes, I see your booking - go on in."

Is this receptionist performing Authentication or Authorisation?

• Neither

• Authentication

• Authorisation

• Both

"Stop! You need to check with reception before going in."

Is this security guard performing Authentication or Authorisation?

• Neither

• Authentication

• Authorisation

• Both

"No dogs except trained service animals."

Is this sign performing Authentication or Authorisation?

• Neither

• Authentication

• Authorisation

• Both

"You must be this tall to ride."

Is the ride attendant saying you can't ride because you're too short performing Authentication or Authorisation?

• Neither

• Authentication

• Authorisation

• Both

"You over 18 mate?"

The bouncer checks if your ID is real and you are over 18, and stops you going in if not. Is he performing Authentication or Authorisation?

• Neither

• Authentication

• Authorisation

• Both

This card-reader only unlocks the door if you have a valid keycard. Is it performing Authentication or Authorisation?

• Neither

• Authentication

• Authorisation

• Both

This login page requires a matching username and password to log the user in. Is it performing Authentication of Authorisation?

• Neither

• Authentication

• Authorisation

• Both

The server is set up to only return some content if a valid token is sent with the request. Is the server performing Authentication or Authorisation?

• Neither

• Authentication

• Authorisation

• Both

Access Controls are responsible for managing what?

• Authentication

• Authorisation

• Data Integrity

• Confidentiality

Broken access controls are ranked at what position in the OWASP Top 10 for 2021?

• 1

• 5

• 7

• 9