User Access Restriction

User access restriction means stopping people who should not be there from reaching a system and the data on it. Some of that is done with software settings, such as passwords, but access can also be restricted in the real world: physical security controls who can get near the equipment. If an attacker cannot reach a machine, they cannot switch it on, plug anything into it or carry it away.

For example, a garden centre keeps its customer orders on a computer in a back office. The office door is locked while the shop is open, the yard gate is shut after trading, and visitors sign in at the till and are accompanied. Someone browsing the plant area never gets within arm's reach of the machine.

What physical measures prevent

• Theft of equipment — a thief who cannot get into the office cannot walk off with the computer.
• Damage — fewer people near a machine means fewer accidents, such as a sack trolley being wheeled into a desktop tower, as well as less deliberate damage.
• Theft of data — a machine left logged in and unattended lets a passer-by open the customer records and photograph the screen. Someone who reaches a port could also copy files onto a memory card or portable drive and walk away with them.
• Installation of malware — some malware arrives on equipment that someone plugs into a port, such as a phone charging or a tablet brought in from home. If only trusted staff can reach the ports, that route is closed.

Deterrence

A physical measure also deters attackers: a barrier, a staffed reception, a sign-in sheet or a locked door makes an intruder expect to be seen or stopped, so many do not attempt it. Physical security is wider than locks, the best-known example. Deterrence lowers the number of attempts rather than making equipment impossible to reach, so it works alongside software restrictions such as levels of permitted access.

Locks are a physical security measure. They control who can reach a room, cabinet or device, so they can secure rooms, equipment and devices. Keeping a device behind a locked door also helps protect the data on it, because an unauthorised person cannot get to the device to take it or use it.

Manual locks

A manual lock uses a key or dial rather than electronics or an IT system. A padlock on a storage cupboard, or a dial lock on a cash box, makes theft more difficult by keeping the contents locked away. A thief must spend time breaking or picking the lock, which increases the chance of being noticed. For example, a youth theatre keeps its lighting controller in a locked cupboard, so a visitor cannot simply carry it away.

Door locks used with keys have drawbacks. A key might be duplicated, mislaid or taken by someone else, and a simple lock often leaves no record of who opened it and when. If a key goes missing or is taken, the lock may have to be replaced so the building stays protected. A door lock can also be bypassed or picked, so it slows down a determined intruder rather than stopping every one.

Electronic locks

An electronic lock checks an electronic credential, such as a keypad code, before it opens. It can be programmed to allow only authorised users or credentials, and access rights need careful management when they change. For example, a school keeps its server rack behind a keypad lock; the code is changed at the end of each term so only the current IT team can open it. The user must remember the code, and a code can be shared or guessed, so it should be changed if it is no longer private. Some electronic locks open with a card rather than a keypad code. The user must carry the card, and it can be damaged, lost, stolen or copied.

A password is a widely used access restriction: it asks you to provide a secret before a system will let you in. You type the secret and the system checks it against the password record it holds for your account. If the two match, access is allowed; if they do not, access is refused.

stored_password = "Maple42"
entered_password = input("Enter password: ")

# compare the typed secret with the stored one
if entered_password == stored_password:
    print("Access granted")
else:
    print("Access denied")

Output when the user types Maple42:

Enter password: Maple42
Access granted

Passwords are simple and low cost. They need no special equipment beyond a keyboard, so they work on almost any device, and a system can hold passwords for thousands of users without buying extra hardware. They can also be changed whenever you need to: if you think someone else has learned your secret, you replace it with a new one and the old secret stops working.

The password must stay secret

A password is only effective while it stays secret. The system cannot tell the difference between you and anyone else who knows your secret, so if someone watches you type it, or reads it from a note beside the screen, it has stopped being a secret and no longer protects the account.

Hard to guess, hard to remember

A strong password is harder for someone to guess, but it can also be difficult to remember. A long, random mix of characters is not easy to recall, so a user might write it down or swap it for something memorable but easy to guess, which weakens the protection.

People may also reuse passwords across systems. For example, if the same secret unlocks a photo-sharing app and your school email account, a leak from the app could give an attacker a working password for the email account. One compromised password can therefore put several systems at risk.

A password policy is a set of rules an organisation writes to control how passwords are created and how they are looked after once in use. It turns vague advice such as "pick a good password" into clear checks that staff can follow and that a system can enforce.

Rules for creating passwords

A password is strong when it is long, because every extra character multiplies the number of guesses an attacker must make. It should also mix character types — capitals, lower-case letters, digits and symbols — so that guessing software cannot assume a narrow set of possibilities. It should avoid personal information anyone could find out, such as a favourite film or a street name, and avoid predictable sequences that attackers try first.

Strong passwords are also never reused across accounts. If one service is breached, a reused password hands the attacker the keys to every other account it opens, so a policy bans recycling and requires a fresh password each time.

Rules for protecting passwords

• Keep every password secret and never share it, even with a trusted colleague or IT staff.
• Do not write passwords down on paper, sticky notes or an unprotected file where someone could read them.
• Shield the keyboard or screen when typing so nobody can read the password over your shoulder.
• Change passwords regularly, and immediately if a breach is suspected, so a stolen password stops working.

Tools that support a policy

A password generator produces a random string of characters that is not a recognised word, so dictionary-based attacks fail and the user is not tempted to invent something guessable. A password checker tests a password against the policy — its length, its character mix and whether it appears in known lists of leaked passwords — and rates it weak or strong, so that a weak one can be replaced before it causes a problem.

An access level (also called a permission level, or level of permitted access) is a setting that decides what a user is allowed to do once they have logged in. Correct settings mean each person can reach the parts of a system their work needs, and nothing else.

Three typical levels

Read only is the safest of the three levels, because a user cannot damage or remove anything even by accident. Full control is the most powerful and the most risky, since it lets someone lock other people out or wipe stored data, so very few accounts should have it.

Choosing the right amount

The rule to follow is least privilege: give each user the minimum access they need to do their job. Too much access raises the risk, because a careless or dishonest user can then alter or delete information they should never have seen. Too little access causes a different problem, as people cannot finish their tasks and may start sharing logins or asking a colleague with higher access to do the work for them, which weakens security further. Finding the right balance between too much and too little access is important.

For example, in a veterinary practice's booking system, receptionists need read/write access to appointments so they can book and move them, but read-only access to animal treatment records. Vets need read/write on those records to add notes after a check-up. Only the practice manager has full control, so that new staff accounts and access levels can be set up.

What biometrics are

Biometrics authenticate a user by measuring a physical or behavioural characteristic that is unique to that person, such as the shape of an ear. You present the characteristic to a scanner, which compares it with a stored template. If the two match, access is granted.

Benefits and drawbacks for the user

Biometrics can be quick, because there is no password to remember and no card to carry. But a scan can fail to recognise a genuine user, which is called a false negative. This can happen because of physical changes, such as a cut, swelling or a bandage covering the characteristic, or because the user's head is not in the right position.

Some scanners need you to touch a pad or rest your hand on a surface, and a surface used by lots of people can pass on germs, so these scanners can be unhygienic.

Cost, setup and data risks

Biometrics can be expensive to buy, set up, install, maintain and repair because they need specialist equipment and expert work. Setting up is time-consuming, as every authorised user must be enrolled: their biometric data is recorded as a template before they can use the system. For example, a bakery chain uses ear-shape scanners to unlock its tills. Staff save time at the start of a shift, but the scanners cost more than keypads, a new baker must be enrolled before their first shift, and a broken scanner can leave a till out of action until it is fixed. If biometric data is compromised it cannot be changed like a password, and stolen data could be used to access other systems. Some people are also uneasy about a computer keeping a record of their biometrics.

Multi-factor authentication (MFA) is an access restriction that asks you to prove who you are in more than one way before a system lets you in. Each way is called a factor, and the factors must come from different types — typing two different passwords is not multi-factor, because both are the same type.

The three factor types

Why more than one factor is safer

A single method fails the moment that one secret leaks. Requiring a second, different factor means an attacker who learns your memorised phrase still cannot get in, because they do not also hold your registered object.

For example, the volunteer coordinator at a city farm opens the rota system by typing a phrase she has memorised, then approves a prompt on the smart watch registered to her account. Someone who sees her type the phrase still cannot log in without her watch. With only the phrase, that person would have been straight in.

Drawbacks

• It is slower: every login takes two steps instead of one, which staff may find inconvenient on a busy day.
• A factor can be lost or left behind, such as a registered device, which locks out the genuine user until it is replaced.
• Issuing and managing the extra factors takes time and money.

Two-factor authentication (2FA) is a way of restricting access to a system by asking for two different authentication factors. Using two passwords does not count, because both are the same factor: something you know. The two factors must be different types, such as something you know and something you have, or something you know and something you are.

2FA is the most common form of multi-factor authentication. Multi-factor authentication means using more than one factor, but 2FA uses exactly two of the three factor types. That extra step makes it harder for someone who has stolen or guessed your password to get in, because they still need the second factor.

A common method is a password plus a temporary one-time code. The code is sent to a device or account that only the real user controls, such as their own phone, so a thief with your password still cannot read it. When you explain 2FA, always say where the code is sent, for example 'a code is sent to the user's phone', rather than only saying that a code is used: a code that anyone could receive proves nothing.

Other second factors

Security questions can be used as a second check because the real account holder is the person expected to recall the answers. They are still a knowledge factor, so they only form part of two-factor authentication when the other factor is a different type, such as something you have.

Biometrics can be used as a second check by matching a scan against stored biometric data. After typing a password, you might scan a unique body feature that is compared with the copy saved for your account; a match lets you in.