By the end of this lesson you will be able to
- Explain the difference between authentication and authorisation with an example.
- Compare something you know, have and are, and say why combining them is stronger.
- Describe how a firewall, a separate guest network and closed ports reduce risk.
- State the rules of ethical practice and why permission matters in law.
- Plan a safe, legal practice lab on equipment you own.
Every secure system has to answer two questions: who are you, and what are you allowed to do? It also has to stop strangers from reaching things they should not touch across a network. Understanding these answers helps you protect your own accounts and prepares you for any further study in security. There is one rule above all the others: you practise only on systems you own or have clear written permission to test. This lesson explains why, and how to build a safe place to learn.
Authentication and authorisation
Authentication is proving who you are. Authorisation is the decision about what you may do once the system knows who you are. They happen in that order. At a cinema, showing your ticket is authentication of a kind, and the ticket saying screen 3, not screen 4, is authorisation. On a computer, typing your password signs you in, and file permissions decide which files you may open. A system can be strong at one and weak at the other. A perfect login does not help if every signed-in user can read every file.
Read this figure as text
A sequence between a user, a login page and a file server showing sign-in and then an allowed and a refused request.
Three actors: Amina, Login system, File server. 1 Amina sends her user name and proof (password and a code). 2 The login system checks them and replies: identity confirmed. This is authentication. 3 Amina asks the file server to open the shop prices file. 4 The server checks permissions and replies: allowed. 5 Amina asks to open the payroll file. 6 The server replies: refused, you are not authorised. This is authorisation. All names and files are fictional.
Three kinds of proof, and why to combine them
There are three kinds of proof, called factors. Something you know: a password or PIN. Something you have: a phone running an Authenticator app, a hardware security key or a bank card. Something you are: a fingerprint or face scan. A password alone can be guessed, stolen or reused from a Data breach. When a second kind of proof is added, as in Multifactor authentication (MFA), an attacker who has only the password still cannot get in. A Passkey goes further: it replaces the password with a secret held on your device, unlocked by your fingerprint, face or device PIN, and it cannot be typed into a fake website.
| Method | Kind | Strength | Weakness |
|---|---|---|---|
| Password alone | Know | Free and familiar | Guessed, reused, phished |
| Password plus code from an authenticator app | Know and have | Stops most password-only attacks | A fake site can still trick you into typing the code |
| Code sent by text message | Know and have | Better than nothing | Text messages can be redirected; use an app where possible |
| Hardware security key or passkey | Have and know or are | Resists phishing, because it checks the real site | Needs a device; keep a recovery method |
Network defence basics
A network is a set of doors. A Firewall is a guard at the doors that allows or blocks connections by rule. A typical home rule is: let my devices connect out, and block unrequested connections coming in. Every open Network port on a device is a door that a program is listening behind, so close, or do not install, what you do not use. Together with the lesson on attack surface, the aim is few doors, each watched.
A second idea is separation. Put devices of different trust levels on different networks so that a problem in one cannot spread freely to the others. Many home routers offer a guest Wi-Fi network. Visitors and smart devices such as a television or camera go there. Your laptop and the shop till stay on the main network. If a visitor's phone carries malware, it cannot see your laptop.
Read this figure as text
A network diagram of a router connecting a main network with a laptop to the internet and a separate guest network with phones and a camera.
A network diagram. At the top, the internet connects to a router with a built-in firewall. Under the router are two zones. The Main network zone holds Amina's laptop and a printer. The Guest network zone holds a visitor's phone and a smart camera. The links from the router to the laptop and the printer are wireless. The guest devices have their own links, and a note says guest devices can reach the internet but not the main network.
Look at your own network defences
Read only. Do not change router settings unless you know how to undo them.
Ubuntu includes a firewall called ufw (uncomplicated firewall). It is installed but not enabled by default. Reading its state needs administrator power, so use sudo ufw status in your own terminal and enter your own password only at the prompt that appears on your own computer. If it reports Status: inactive, the firewall is off. Behind a home router that also blocks unrequested connections this is usually acceptable, but on a laptop used in cafes you may wish to turn it on after reading the ufw documentation. Do not type your password anywhere else.
sudo ufw statusOpen Windows Security from Start, choose Firewall and network protection, and read the status of the Domain, Private and Public networks. For a cafe or any shared Wi-Fi the Public profile applies and should be on. Do not switch a firewall off to make something work. Instead use Allow an app through firewall for a program you trust.
Ethics and the law: permission comes first
Skills that protect systems can also be used to harm them, so the field has firm rules. Most countries have laws against gaining access to a computer without permission, even if nothing is damaged or stolen and even if you meant well. Examples include the UK Computer Misuse Act 1990 and Kenya's Computer Misuse and Cybercrimes Act of 2018. Laws differ by country, so check those of yours, but the principle is shared: authorised access is legal, unauthorised access is not. Looking around someone else's network, even only to see if it is weak, can be a crime.
Professional testers work under a written agreement that names exactly which systems may be tested, when and how. This is called Penetration testing and the permission is what makes it legal. For a learner the rule is simple, and has three parts.
- Own it or be allowed it. Practise only on equipment you own, or in a lab environment that explicitly invites testing.
- Stay inside the lines. If a document says you may test one thing, test only that one thing, only in the agreed way.
- Report, do not exploit. If you accidentally discover a weakness in someone else's system, do not explore further. Tell the owner calmly and politely, using the contact details on their site.
- Your own devices
- A virtual machine you built
- A practice site made for learning
- Written permission with a scope
Practise here
- A neighbour's Wi-Fi
- School or work systems without permission
- A website you do not own
- Because it looked weak or a friend dared you
Never, even from curiosity
Read this figure as text
Two columns comparing safe, legal practice with illegal practice.
Two columns. Safe and legal: your own laptop, a virtual machine you built, a practice application made for learning, an organisation's written permission that lists the systems and dates. Verdict: practise here. Not safe and not legal: a neighbour's Wi-Fi, your school or employer's systems without written permission, a website you do not own, any system because it looks weak or because a friend dared you. Verdict: never, even out of curiosity.
Building a safe practice lab
A lab is a place where breaking things is allowed because nothing real depends on it. The usual first lab is a Virtual machine: a pretend computer that runs inside a window on your real one. If you damage it, you delete it and start again. Free tools such as VirtualBox can run a virtual machine, and you can install Ubuntu inside it. For practice targets, choose projects designed to be attacked by learners, such as the OWASP Juice Shop, which runs on your own computer, or learning platforms that give you an authorised target and set clear rules. Read their rules first.
Safe to break
Read this figure as text
A stack showing the real computer, a virtualisation program, a lab virtual machine and a practice target.
A stack of layers. Bottom: your real computer with your real files. Above it: a virtualisation program such as VirtualBox. Above that: a lab virtual machine with no personal files, which you can delete and rebuild. At the top: a practice target made for learners. A note says take a snapshot before experiments so that you can go back, and keep the lab network isolated from your real files and accounts.
Common mistakes
✖ Instead of: Thinking a strong login means every file is safe.
✔ Do this: Authorisation also matters: check which accounts can read and change each file.
✖ Instead of: Testing a system because it looks weak, with no permission.
✔ Do this: Test only systems you own or have written permission for. If you spot a weakness elsewhere, report it and stop.
✖ Instead of: Relying on text-message codes when an authenticator app or passkey is available.
✔ Do this: Use the strongest method the service offers and keep recovery codes safe.
✖ Instead of: Switching off the firewall to make a program connect.
✔ Do this: Allow only that trusted program through the firewall, or ask why it needs access.
If something goes wrong
sudo ufw statussayscommand not found.- The ufw firewall may not be installed on your version or has been removed. Check the Ubuntu documentation before installing anything, and meanwhile rely on the router's firewall.
- My authenticator app codes are rejected.
- Codes depend on the correct time. Make sure your phone's clock is set automatically. If it still fails, use a recovery code and set the app up again.
- I lost the phone with my authenticator app.
- Use the recovery codes you saved when you turned on multifactor authentication, or the service's account recovery process. Then add a new device and save new recovery codes.
- My virtual machine will not start.
- Check that virtualisation is enabled in your computer's firmware settings, that you gave it enough memory and disk space, and read the exact error message in the virtualisation program's documentation.
Key terms
- Authentication
- Proving that you are who you say you are, for example with a password and a code.
- Authorisation
- Deciding what an identified person is allowed to do.
- Penetration testing
- Testing a system's security by carefully trying to break in, only with the owner's written permission.
- Passkey
- A sign-in method that replaces the password with a key held on your device and unlocked by your fingerprint, face or screen lock.
- Firewall
- A security feature that blocks unwanted network connections to or from your computer.
- Virtual machine
- A pretend computer, run as a program on a real computer, with its own system and files.
Practise it for real
Reading is not the same as being able to do it. Complete these on your own computer, then tick only what you have actually done. These ticks are your own honest record: nothing checks them for you.
Audit how you prove who you are
List your five most important accounts, such as email, bank, phone provider, shop and social media. For each, write which proof factors it uses today: password only, password plus code, or passkey. Mark the two accounts that are most valuable and weakest. Then write what you will change first, for example turning on an authenticator app for your email, and check that you have saved its recovery codes somewhere safe. Do not write real passwords anywhere in the list.
Plan a safe lab on paper
Write a one-page plan for a practice lab: which computer will host it, what virtualisation program, how much disk space and memory you will give the virtual machine, what you will practise on, and the three rules you will follow (own it or be allowed, stay inside the lines, report not exploit). Add a line that says what you will do before each experiment, such as taking a snapshot. Do not install or attack anything yet.
Challenge: decide what is allowed
For each situation, say whether it is allowed and why, using the three rules. One: testing the password strength of your own Wi-Fi from your own laptop. Two: scanning a classmate's laptop because you are curious. Three: noticing that a local shop's website shows customer lists to anyone who types a certain address. Four: running a deliberately vulnerable app on your virtual machine. Write what you would do in situation three.
Knowledge check
6 questions. You need 80% to pass. Mistakes here are part of learning, and you can retry as often as you like.
Summary
- Authentication proves who you are. Authorisation decides what you may do.
- Combining kinds of proof is stronger, and passkeys resist fake sites.
- Firewalls, few open ports and a separate guest network reduce the network's attack surface.
- Permission is what makes security testing legal. Own it or be allowed it.
- Practise in a lab you can break and rebuild, and report weaknesses instead of exploring them.
Checklist: can you do these?
Marking a lesson as read does not prove you can do it. Skills count as demonstrated when you pass the quiz (not yet) and complete the practical tasks (not yet).
Related lessons
References and further reading
Official sources for details that can change between versions.
- Computer Misuse Act 1990 (UK Government legislation service)
- OWASP Juice Shop project (OWASP Foundation)
- Cyber security guidance for individuals and families (National Cyber Security Centre (UK))