Authentication, Authorization, and Encryption

Let us break down each term from the ground up. Imagine you are a security guard at a company server room. Your job is to decide who can enter and what they can do once inside.

Authentication is the process of verifying identity. It answers the question: "Who are you?"

When a user wants to log into a server, they must prove their identity. The most common method is a username and password. But passwords alone are weak — they can be stolen or guessed. That is why modern systems use multi-factor authentication (MFA), which requires at least two of the following three factors:

When you type your password and then approve a push notification on your phone, you have used MFA. Servers often require MFA for remote administration to prevent unauthorised access even if a password is compromised.

Authorization happens after authentication. It answers: "What are you allowed to do?"

Once the server knows who you are, it checks a set of rules — called permissions or access controls — to decide whether you can read, write, delete, or execute specific files or applications. A simple example: the server's operating system assigns each user a security identifier (SID) and compares it to the access control list (ACL) on each resource. The ACL is a list that says which users or groups have which permissions.

There are different models for managing authorization. The most common one for servers is role-based access control (RBAC). In RBAC, administrators create roles (like "backup operator" or "database admin") and assign permissions to each role. Users are then added to roles, inheriting the permissions automatically. This makes it easy to grant the same set of permissions to many people without configuring each one individually.

For the SK0-005 exam, you need to know the difference between authentication and authorization, and be able to identify scenarios where each applies. A common trap is that a user who has authenticated but not been authorised will be denied access to a resource — the server will return an "access denied" error, not a "login failed" error.

Encryption is the process of scrambling data so that only someone with the correct key can read it. It protects data in two main states: - Data at rest: stored on a hard drive, database, or backup tape. - Data in transit: moving across a network, such as between a web browser and a server, or between two servers.

Encryption uses mathematical algorithms and keys. A key is a string of bits that controls the scrambling and unscrambling. There are two types: - Symmetric encryption: the same key is used to encrypt and decrypt. Fast but requires securely sharing the key. - Asymmetric encryption: uses a pair of keys — a public key (shared openly) and a private key (kept secret). Data encrypted with the public key can only be decrypted with the private key. This is the basis for SSL/TLS (Secure Sockets Layer / Transport Layer Security).

SSL/TLS is the cryptographic protocol that secures web traffic (HTTPS). When you visit a secure website, the server presents a digital certificate. This certificate contains the server's public key and is signed by a trusted third party called a certificate authority (CA). Your browser uses the CA's public key to verify the certificate is genuine. Then a symmetric session key is exchanged using asymmetric encryption, and all subsequent data is encrypted with that session key.

Certificates themselves contain identity information and are used to authenticate the server (and optionally the client) before encryption starts. Without certificates, you could be talking to an impostor.

Why does this matter for a beginner? Because every server administrator must configure encryption for remote access (e.g., SSH for Linux, RDP with TLS for Windows), enable HTTPS for web services, and manage certificates. The SK0-005 exam tests your ability to select the correct encryption protocol for a given scenario and understand the role of certificates.

Together, the three concepts form a security chain: authentication confirms identity, authorisation grants appropriate access, and encryption protects the data that flows between authenticated users and authorised resources. A failure in any one link breaks the entire security model.

Meet Alex, a junior IT administrator at a medium-sized company. The company has just deployed a new web server that hosts an internal employee portal. Alex’s first task is to secure it.

Here is what Alex actually does, step by step.

Step 1: Configure authentication for server access. Alex sets up local user accounts on the Windows Server. Each employee who manages the server needs a unique username and a strong password. But Alex knows passwords alone are risky, so he enables multi-factor authentication (MFA) using the Microsoft Authenticator app. Now, every time an admin logs in remotely via RDP, after entering their password they must approve a notification on their phone.

Step 2: Request and install an SSL/TLS certificate. The employee portal must be accessible over HTTPS. Alex generates a certificate signing request (CSR) from the server and submits it to a public certificate authority (CA) like DigiCert. The CA verifies that the company owns the domain name (e.g., portal.company.com) and issues a certificate. Alex then installs the certificate on the web server and binds it to the HTTPS port (443). He also configures the server to enforce TLS 1.2 or higher and disables older, insecure protocols like SSLv3.

Step 3: Define authorization with RBAC. Alex creates three roles in Active Directory: - Web Admins: can stop/start the web service, update application files, and view logs. - Backup Operators: can only run backup jobs and restore files. - Auditors: can only read logs.

He adds users to the appropriate groups. When a user logs in, the server checks the group membership and applies the corresponding access control entries (ACEs) to files and registry keys. A backup operator who accidentally tries to delete the web application gets an access denied error.

Step 4: Test the setup. Alex simulates attacks using a vulnerability scanner. He also tries to access the portal from a browser without a valid certificate — the browser shows a warning. He verifies that MFA is working by attempting login from an unauthorised device; the push notification fails.

Step 5: Monitor and maintain. Alex sets up certificate expiry alerts. Certificates typically last one to two years. He documents the renewal process. He also reviews authentication logs weekly to spot any brute-force attempts. If the server detects too many failed logins, an automatic script blocks the offending IP address.

This real-world scenario shows that authentication, authorisation, and encryption are not just textbook concepts. Every day, IT professionals install certificates, configure permissions, enable MFA, and troubleshoot why a user cannot access a resource. For the SK0-005 exam, you must be able to walk through a similar process and choose the right tools and protocols.