WHAT YOU WILL LEARN
Learning objectives
- Separate authentication from authorisation
- Explain the role of passkeys and session controls
- Review privileges through a user’s lifecycle
Authentication is only the first decision
A successful sign-in establishes an identity claim; authorisation decides what that identity can do. Use named accounts and grant the minimum access required for the role. Review privileges when responsibilities change and remove access through a controlled offboarding process. Shared administrator credentials make attribution and revocation harder.
Prefer phishing-resistant authentication where supported
Passkeys and security keys can reduce exposure to credential phishing. They do not remove the need to secure recovery, endpoints and existing sessions. Document supported authenticators and recovery procedures. A strong front door can still be undermined by an unreviewed recovery route or a long-lived stolen session.
Reduce standing privilege
Separate everyday activity from administrative work. Time-bound elevation and approvals can reduce how long privileged access is available. Review service accounts and application credentials as well as human users. Use logs to answer who accessed what, when and under which approval.
APPLIED EXAMPLE
Put it in context
A fictional payroll administrator moves to a new department. Their role changes promptly, privileged sessions are reviewed and emergency access remains independently controlled. The organisation does not wait for an annual review to remove obsolete payroll rights.
Illustrative scenario for learning, not a claim about a verified customer incident.Common mistakes
- Treating MFA as authorisation
- Ignoring service-account privileges
- Leaving old roles active
Your practical checklist
Checklist ticks are temporary and are not recorded as account progress.
MINI RECAP
Strong authentication and least privilege solve different parts of account risk; maintain both.
Put your understanding to the test.
Go further in the Network Security Track
The free base is available now. Applied labs, assessed evidence and authenticated history are planned extensions.
Explore the learning track →