User authentication and authorization in SCADA systems - Mini Project: Build & Apply

User authentication and authorization

📖 Scenario: You are working on a SCADA system that controls industrial equipment. To keep the system safe, only authorized users should access certain controls. You will create a simple user authentication and authorization setup.

🎯 Goal: Build a basic user authentication and authorization system that stores user credentials, sets a required access level, checks user credentials, and prints if access is granted or denied.

📋 What You'll Learn

Create a dictionary with exact usernames and passwords

Add a variable for the required access level

Write a function to check user credentials and access level

Print the access result message

💡 Why This Matters

🌍 Real World

SCADA systems control critical industrial processes. Securing access prevents unauthorized control that could cause damage or safety hazards.

💼 Career

Understanding authentication and authorization is essential for DevOps engineers managing secure infrastructure and access control.

1

Create user credentials dictionary

Create a dictionary called users with these exact entries: 'operator1': {'password': 'op123', 'access_level': 1}, 'engineer1': {'password': 'eng456', 'access_level': 2}, 'admin1': {'password': 'adm789', 'access_level': 3}.

SCADA systems

# Create the users dictionary with usernames, passwords, and access levels
# Your code here

Hint

Use a dictionary where each username maps to another dictionary with keys 'password' and 'access_level'.

2

Set required access level

Create a variable called required_access_level and set it to 2 to represent the minimum access level needed to control the system.

SCADA systems

users = {
    'operator1': {'password': 'op123', 'access_level': 1},
    'engineer1': {'password': 'eng456', 'access_level': 2},
    'admin1': {'password': 'adm789', 'access_level': 3}
}
# Set the required access level variable
# Your code here

Hint

Just assign the number 2 to the variable required_access_level.

3

Write authentication and authorization function

Write a function called check_access that takes username and password as parameters. It should check if the username exists in users, the password matches, and the user's access level is greater than or equal to required_access_level. Return True if all checks pass, otherwise False.

SCADA systems

users = {
    'operator1': {'password': 'op123', 'access_level': 1},
    'engineer1': {'password': 'eng456', 'access_level': 2},
    'admin1': {'password': 'adm789', 'access_level': 3}
}
required_access_level = 2
# Define the check_access function
# Your code here

Hint

Use an if statement to check username, then check password and access level inside.

4

Print access result

Call the function check_access with username = 'engineer1' and password = 'eng456'. Print 'Access granted' if the function returns True, otherwise print 'Access denied'.

SCADA systems

users = {
    'operator1': {'password': 'op123', 'access_level': 1},
    'engineer1': {'password': 'eng456', 'access_level': 2},
    'admin1': {'password': 'adm789', 'access_level': 3}
}
required_access_level = 2

def check_access(username, password):
    if username in users:
        user = users[username]
        if user['password'] == password and user['access_level'] >= required_access_level:
            return True
    return False

# Call check_access with username 'engineer1' and password 'eng456' and print result
# Your code here

Hint

Use an if statement to print the correct message based on the function result.

Practice

1. What is the main purpose of user authentication in a SCADA system?

easy

A. To backup system data

B. To confirm the identity of a user

C. To monitor system performance

D. To control what actions a user can perform

Solution

1. Step 1: Understand authentication concept

   User authentication is about verifying who the user is.

2. Step 2: Differentiate from authorization

   Authorization controls permissions, not identity confirmation.

3. Final Answer:

   To confirm the identity of a user -> Option B

4. Quick Check:

   Authentication = Confirm identity [OK]

Hint: Authentication = Who you are, Authorization = What you can do [OK]

Common Mistakes:

• Confusing authentication with authorization
• Thinking authentication controls permissions
• Mixing system monitoring with user identity

2. Which of the following is the correct syntax to define a user role with read-only access in a SCADA system configuration file?

easy

A. role read_only { permissions: ["read"] }

B. role read_only = permissions: read

C. role: read_only { access = read }

D. read_only role { permissions = read }

Solution

1. Step 1: Identify correct role syntax

   The correct syntax uses 'role' keyword, role name, and permissions list in braces.

2. Step 2: Check option formats

   role read_only { permissions: ["read"] } correctly uses braces and array syntax for permissions.

3. Final Answer:

   role read_only { permissions: ["read"] } -> Option A

4. Quick Check:

   Correct role syntax uses braces and permission array [OK]

Hint: Look for braces and array syntax for permissions [OK]

Common Mistakes:

• Using '=' instead of ':' for permissions
• Missing braces around role definition
• Incorrect order of keywords

3. Given the following SCADA user permissions code snippet:

user = { name: "operator", roles: ["read_only", "control"] }
roles = {
  read_only: { permissions: ["read"] },
  control: { permissions: ["write", "execute"] }
}

What permissions does the user "operator" have?

medium

A. ["read"]

B. ["write", "execute"]

C. ["read", "write", "execute"]

D. ["read", "write"]

Solution

1. Step 1: Identify roles assigned to user

   User "operator" has roles "read_only" and "control".

2. Step 2: Combine permissions from both roles

   "read_only" grants ["read"], "control" grants ["write", "execute"]. Combined permissions are ["read", "write", "execute"].

3. Final Answer:

   ["read", "write", "execute"] -> Option C

4. Quick Check:

   Combine all role permissions for user [OK]

Hint: Add permissions from all user roles together [OK]

Common Mistakes:

• Selecting permissions from only one role
• Forgetting to merge permissions
• Confusing role names with permissions

4. A SCADA system admin tries to assign a user a role using this command:
assign_role user1 admin
But the system returns an error: "Role 'admin' not found." What is the most likely cause?

medium

A. The role 'admin' is not defined in the system

B. The user 'user1' does not exist

C. The command syntax is incorrect

D. The system is offline

Solution

1. Step 1: Analyze error message

   Error says "Role 'admin' not found," indicating the role is missing.

2. Step 2: Check command and user existence

   Command syntax looks correct and error does not mention user, so user likely exists.

3. Final Answer:

   The role 'admin' is not defined in the system -> Option A

4. Quick Check:

   Error message points to missing role [OK]

Hint: Check error message for missing role or user [OK]

Common Mistakes:

• Assuming user does not exist without checking
• Blaming command syntax without error details
• Ignoring error message content

5. In a SCADA system, you want to restrict a user so they can only read data but not control devices. Which approach best achieves this?

hard

A. Disable user authentication for faster access

B. Assign the user multiple roles including control

C. Grant the user admin privileges temporarily

D. Assign the user a role with only read permissions

Solution

1. Step 1: Understand requirement

   User must only read data, no control allowed.

2. Step 2: Choose role assignment

   Assigning a role with only read permissions restricts actions properly.

3. Step 3: Evaluate other options

   Assigning control roles or admin privileges contradicts restriction; disabling authentication is insecure.

4. Final Answer:

   Assign the user a role with only read permissions -> Option D

5. Quick Check:

   Restrict actions by role permissions [OK]

Hint: Use roles with minimal permissions to restrict users [OK]

Common Mistakes:

• Giving users more permissions than needed
• Disabling authentication to simplify access
• Using admin roles for normal users