FC0-U61 Objective 6.4: Compare and Contrast Authentication, Authorization, Accounting and Non-Repudiation Concepts

September 16, 2025•34 min read•CompTIA IT Fundamentals

FC0-U61 Exam Focus: This objective covers the four fundamental security concepts: Authentication (single factor, multifactor, examples of factors including password, PIN, one-time password, software token, hardware token, biometrics, specific location, security questions, single sign-on), Authorization (permissions, least privilege model, role-based access, user account types, rule-based access, mandatory access controls, discretionary access controls), Accounting (logs, tracking, web browser history), and Non-repudiation (video, biometrics, signature, receipt). Understanding these concepts is essential for information security.

Understanding the Four Pillars of Security

Authentication, Authorization, Accounting, and Non-repudiation form the foundation of information security. These four concepts work together to create a comprehensive security framework that ensures proper access control, accountability, and legal protection. Understanding how these concepts differ and complement each other is crucial for implementing effective security measures and maintaining a secure environment.

The Four Security Pillars:

Authentication: Verifying who you are
Authorization: Determining what you can do
Accounting: Tracking what you did
Non-repudiation: Proving what you did

Authentication

Authentication is the process of verifying the identity of a user, system, or entity. It answers the question "Who are you?"

Single Factor Authentication

Single factor authentication uses only one method to verify identity:

Single Factor Characteristics:

One verification method: Uses only one type of credential
Lower security: Less secure than multifactor authentication
Easier to compromise: Single point of failure
Common examples: Username and password only
Cost effective: Lower implementation cost
User friendly: Easier for users to remember
Widely supported: Supported by most systems
Basic protection: Provides basic identity verification

Multifactor Authentication

Multifactor authentication uses multiple methods to verify identity:

Multifactor Characteristics:

Multiple verification methods: Uses two or more factors
Higher security: More secure than single factor
Defense in depth: Multiple layers of protection
Reduced risk: Lower risk of compromise
Compliance requirements: Often required by regulations
Higher cost: More expensive to implement
User complexity: More complex for users
Industry standard: Becoming the security standard

Examples of Authentication Factors

Authentication factors are categorized into three main types:

Something You Know (Knowledge Factor)

Knowledge-Based Factors:

Password: Secret word or phrase
PIN: Personal Identification Number
Security questions: Personal questions and answers
Passphrase: Longer, more complex passwords
Pattern: Visual patterns or sequences
Memorable information: Personal information only you know

Something You Have (Possession Factor)

Possession-Based Factors:

Hardware token: Physical device that generates codes
Software token: Application that generates codes
One-time password: Temporary password for single use
Smart card: Card with embedded chip
Mobile device: Phone or tablet for authentication
USB token: USB device for authentication

Something You Are (Inherence Factor)

Biometric Factors:

Fingerprint: Unique fingerprint patterns
Facial recognition: Facial feature analysis
Iris scan: Eye iris pattern recognition
Voice recognition: Voice pattern analysis
Retina scan: Retinal blood vessel patterns
Hand geometry: Hand shape and size

Somewhere You Are (Location Factor)

Location-Based Factors:

GPS location: Geographic location verification
IP address: Network location verification
Wi-Fi network: Connected network verification
Geofencing: Virtual geographic boundaries
Cell tower location: Mobile network location
Office location: Physical office verification

Detailed Authentication Factor Examples

Password

Password Characteristics:

Secret knowledge: Known only to the user
Alphanumeric: Can include letters, numbers, symbols
Length requirements: Minimum length requirements
Complexity rules: Mix of character types
Regular changes: Should be changed periodically
Unique passwords: Different for each account
Storage security: Must be stored securely
Transmission security: Must be transmitted securely

PIN (Personal Identification Number)

PIN Characteristics:

Numeric only: Typically 4-8 digits
Short length: Shorter than passwords
Quick entry: Fast to enter
Common uses: ATMs, mobile devices, keypads
Limited complexity: Less complex than passwords
Physical security: Often used with physical devices
Attempt limits: Limited number of attempts
Lockout protection: Account lockout after failed attempts

One-Time Password (OTP)

OTP Characteristics:

Temporary validity: Valid for limited time
Single use: Can only be used once
Time-based: Generated based on time
Event-based: Generated based on events
Random generation: Cryptographically random
Short lifespan: Expires quickly
Multiple formats: Numeric, alphanumeric, QR codes
Delivery methods: SMS, email, app, hardware token

Software Token

Software Token Characteristics:

Application-based: Software application on device
OTP generation: Generates one-time passwords
Time synchronization: Synchronized with server time
Offline capability: Works without internet connection
Multiple devices: Can be installed on multiple devices
Backup codes: Provides backup recovery codes
User friendly: Easy to use interface
Cost effective: Lower cost than hardware tokens

Hardware Token

Hardware Token Characteristics:

Physical device: Dedicated hardware device
Tamper resistant: Difficult to tamper with
Battery powered: Self-contained power source
Display screen: Shows generated codes
Button activation: User activates to generate code
High security: Very secure authentication method
Single purpose: Dedicated to authentication
Higher cost: More expensive than software tokens

Biometrics

Biometric Characteristics:

Unique characteristics: Based on unique physical traits
Difficult to forge: Hard to duplicate or fake
Convenient: No need to remember passwords
Fast authentication: Quick verification process
Contactless options: Some methods don't require contact
Privacy concerns: Raises privacy considerations
Accuracy requirements: Must be highly accurate
Fallback options: Need backup authentication methods

Specific Location

Location-Based Authentication:

Geographic verification: Verifies user's location
GPS coordinates: Uses GPS for location
IP address: Uses IP address for location
Wi-Fi networks: Uses connected Wi-Fi networks
Cell towers: Uses mobile network towers
Geofencing: Creates virtual boundaries
Risk assessment: Used for risk-based authentication
Privacy implications: Raises privacy concerns

Security Questions

Security Question Characteristics:

Personal information: Based on personal knowledge
Memorable answers: Easy for user to remember
Multiple questions: Usually several questions
Backup authentication: Used for account recovery
Social engineering risk: Vulnerable to social engineering
Public information: Answers may be publicly available
Consistency required: Answers must be consistent
Alternative to passwords: Can replace password authentication

Single Sign-On (SSO)

SSO Characteristics:

One login: Single authentication for multiple systems
Centralized authentication: Central authentication server
Token-based: Uses tokens for authentication
Session management: Manages user sessions
Reduced passwords: Reduces number of passwords
Improved user experience: Better user experience
Centralized management: Easier to manage
Single point of failure: Risk of single point of failure

Authorization

Authorization determines what authenticated users can access and do. It answers the question "What can you do?"

Permissions

Permissions define specific actions users can perform:

Permission Types:

Read: View or access information
Write: Create or modify information
Execute: Run programs or scripts
Delete: Remove information
Modify: Change existing information
Create: Generate new information
Admin: Administrative privileges
Special: Special or custom permissions

Least Privilege Model

The least privilege model grants users only the minimum permissions necessary:

Least Privilege Principles:

Minimum necessary access: Only required permissions
Time-limited access: Access for specific time periods
Task-specific access: Access for specific tasks
Regular review: Regular permission reviews
Automatic revocation: Automatic permission removal
Just-in-time access: Temporary access when needed
Separation of duties: Split critical functions
Default deny: Deny access by default

Role-Based Access Control (RBAC)

RBAC assigns permissions based on user roles:

RBAC Components:

Roles: Defined job functions or positions
Users: Individuals assigned to roles
Permissions: Actions that can be performed
Resources: Objects that can be accessed
Role hierarchy: Roles can inherit from other roles
Dynamic assignment: Roles can be assigned dynamically
Separation of duties: Prevents conflicts of interest
Audit trail: Tracks role assignments and changes

User Account Types

Different user account types have different permission levels:

Common User Account Types:

Administrator: Full system access and control
Power User: Elevated privileges for specific tasks
Standard User: Normal user privileges
Guest User: Limited access for temporary users
Service Account: Account for system services
System Account: Built-in system accounts
Local Account: Account for local machine only
Domain Account: Account for network domain

Rule-Based Access Control

Rule-based access control uses predefined rules to determine access:

Rule-Based Access Characteristics:

Predefined rules: Rules defined in advance
Conditional access: Access based on conditions
Time-based rules: Rules based on time
Location-based rules: Rules based on location
Context-aware: Considers context for decisions
Dynamic evaluation: Rules evaluated dynamically
Centralized management: Rules managed centrally
Audit capability: Can audit rule decisions

Mandatory Access Controls (MAC)

MAC enforces access control based on security labels:

MAC Characteristics:

Security labels: Objects and subjects have security labels
System-enforced: Enforced by the system
Non-discretionary: Users cannot change permissions
Hierarchical levels: Clear hierarchy of security levels
Need-to-know: Access based on need-to-know
Government use: Commonly used in government systems
High security: Provides high level of security
Complex implementation: Complex to implement and manage

Discretionary Access Controls (DAC)

DAC allows object owners to control access to their objects:

DAC Characteristics:

Owner control: Object owners control access
User discretion: Users can grant/revoke access
Access control lists: Uses ACLs for permissions
Flexible: Flexible access control
User-friendly: Easy for users to understand
Common in business: Widely used in business environments
Potential for errors: Users can make mistakes
Less secure: Generally less secure than MAC

Accounting

Accounting tracks and logs user activities and system events. It answers the question "What did you do?"

Logs

Logs record system events and user activities:

Log Types:

System logs: System events and errors
Security logs: Security-related events
Application logs: Application-specific events
Access logs: User access and authentication
Audit logs: Comprehensive audit trails
Error logs: System and application errors
Performance logs: System performance metrics
Transaction logs: Database and transaction records

Log Characteristics

Log Management Features:

Timestamp: When the event occurred
User identification: Who performed the action
Event description: What happened
Source location: Where the event originated
Result status: Success or failure
IP address: Network source of the event
Resource accessed: What was accessed
Additional details: Additional context information

Tracking

Tracking monitors user activities and system usage:

Tracking Capabilities:

User activity: Tracks user actions and behaviors
Resource usage: Monitors resource consumption
Network traffic: Tracks network communications
File access: Monitors file and data access
Application usage: Tracks application usage
Login sessions: Monitors login and logout events
Permission changes: Tracks permission modifications
System changes: Monitors system configuration changes

Web Browser History

Web browser history provides detailed tracking of web activities:

Browser History Components:

URLs visited: Complete list of visited websites
Visit timestamps: When each site was visited
Page titles: Titles of visited pages
Download history: Files downloaded from websites
Form data: Data entered in web forms
Search history: Search queries performed
Bookmarks: Saved website bookmarks
Cache data: Cached website data

Non-Repudiation

Non-repudiation provides proof that an action occurred and cannot be denied. It answers the question "Can you prove what you did?"

Video

Video evidence provides visual proof of actions and events:

Video Evidence Characteristics:

Visual proof: Provides visual evidence of events
Timestamp verification: Includes date and time stamps
Tamper detection: Can detect video tampering
Chain of custody: Maintains evidence integrity
Legal admissibility: Can be used in legal proceedings
Surveillance systems: Used in security surveillance
Meeting recordings: Records of meetings and conferences
Transaction verification: Verifies transaction completion

Biometrics

Biometric data provides unique identification that cannot be easily denied:

Biometric Non-Repudiation:

Unique identification: Unique to each individual
Difficult to forge: Hard to duplicate or fake
Permanent record: Creates permanent identification record
Legal acceptance: Legally accepted as evidence
Access control: Used for access control systems
Transaction verification: Verifies transaction participants
Time stamping: Includes time of biometric capture
Encrypted storage: Biometric data stored securely

Signature

Digital and physical signatures provide proof of agreement or authorization:

Signature Types:

Digital signature: Cryptographic signature for digital documents
Electronic signature: Electronic representation of signature
Physical signature: Handwritten signature on documents
Biometric signature: Signature based on biometric data
Certificate-based: Signature with digital certificate
Timestamped signature: Signature with timestamp
Multi-party signature: Signature from multiple parties
Legal binding: Legally binding signature

Digital Signature Process

Digital Signature Steps:

Document creation: Create the document to be signed
Hash generation: Generate hash of the document
Private key encryption: Encrypt hash with private key
Signature attachment: Attach signature to document
Verification process: Verify signature with public key
Integrity check: Verify document hasn't been modified
Certificate validation: Validate signer's certificate
Timestamp verification: Verify signature timestamp

Receipt

Receipts provide proof of transaction completion and payment:

Receipt Characteristics:

Transaction proof: Proof that transaction occurred
Payment verification: Verifies payment was made
Date and time: Includes transaction date and time
Amount details: Shows transaction amount
Participant information: Identifies transaction participants
Transaction ID: Unique transaction identifier
Digital receipts: Electronic receipt records
Legal validity: Legally valid proof of transaction

Comparison of the Four Concepts

Concept Comparison Table:

Concept	Purpose	Question Answered	When Used
Authentication	Verify identity	Who are you?	Before access
Authorization	Control access	What can you do?	During access
Accounting	Track activities	What did you do?	During and after access
Non-repudiation	Provide proof	Can you prove it?	After action

Integration of the Four Concepts

How the Concepts Work Together:

Authentication first: Users must authenticate before accessing resources
Authorization second: Authenticated users are authorized for specific actions
Accounting throughout: All activities are logged and tracked
Non-repudiation for proof: Evidence is collected for future verification
Continuous monitoring: All four concepts work together continuously
Security layers: Multiple layers of security protection
Compliance support: Supports regulatory compliance requirements
Incident response: Provides data for incident investigation

Best Practices

Authentication Best Practices

Authentication Guidelines:

Use multifactor authentication: Implement MFA wherever possible
Strong password policies: Enforce strong password requirements
Regular password changes: Require periodic password updates
Account lockout policies: Implement account lockout after failed attempts
Session management: Implement proper session management
Biometric security: Use biometrics where appropriate
Token management: Properly manage authentication tokens
Regular audits: Audit authentication systems regularly

Authorization Best Practices

Authorization Guidelines:

Implement least privilege: Grant minimum necessary permissions
Use role-based access: Implement RBAC where appropriate
Regular permission reviews: Review permissions regularly
Separation of duties: Implement separation of duties
Default deny: Deny access by default
Time-limited access: Grant time-limited permissions
Just-in-time access: Provide access when needed
Document permissions: Document all permission grants

Exam Preparation Tips

Key Concepts to Master

Authentication factors: Understand all types of authentication factors
Authorization models: Know different authorization approaches
Accounting methods: Understand logging and tracking
Non-repudiation techniques: Know methods for providing proof
Concept relationships: Understand how the four concepts work together
Implementation practices: Know best practices for each concept
Security benefits: Understand security benefits of each concept
Real-world examples: Know real-world applications of each concept

Study Strategies

Effective Study Approaches:

Understand the flow: Learn how authentication leads to authorization
Practice scenarios: Practice identifying which concept applies
Compare and contrast: Compare different approaches within each concept
Study real examples: Learn from real-world implementations
Understand relationships: Learn how the concepts work together
Focus on differences: Understand what makes each concept unique

Practice Questions

Sample Exam Questions:

What is the primary purpose of authentication?
What type of authentication factor is a fingerprint?
What is the main principle of the least privilege model?
What is the primary purpose of accounting in security?
What type of access control allows object owners to control access?
What is the main purpose of non-repudiation?
What authentication method uses multiple verification factors?
What type of access control is enforced by the system?
What provides proof that a transaction occurred?
What tracks user activities and system events?

FC0-U61 Success Tip: Understanding authentication, authorization, accounting, and non-repudiation concepts is essential for information security. Focus on learning the differences between these four concepts and how they work together. Pay special attention to authentication factors (password, PIN, OTP, software token, hardware token, biometrics, location, security questions, SSO), authorization models (permissions, least privilege, RBAC, user account types, rule-based access, MAC, DAC), accounting methods (logs, tracking, browser history), and non-repudiation techniques (video, biometrics, signature, receipt). Understanding these concepts and their relationships is crucial for implementing effective security measures and maintaining a secure environment.

Previous: Objective 6.3 Summarize Behavioral Security Concepts

Next: Objective 6.5 Explain Password Best Practices