The computer has an account for each valid user, designated by an account ID, and protected by a password known only to the user. Each account also has an explicit or implied set of permissions, which grant or deny the user access to specific files, programs, activities, resources and capabilities. To access the computer, a person enters an account ID and password. The owner of the account is expected to keep the password secret, so anyone who enters an account ID and its associated password is authenticated to be the user of the account. The user is automatically authorized to engage in any activities allowed by the permissions granted to the account.
Outsiders often attack computers by guessing or stealing account IDs and passwords.
An attacker who gains access to an account can do anything the legitimate user can do. At a higher level of capability, attackers who impersonate users who own files can delete those files or deny legitimate data access to other users. At the highest level of capability, attackers who impersonate users with administrator access can destroy accounts and files, disrupt applications, crash computers or networks, and lock out legitimate administrators. The foundation of most user access control is good password control. Historically, simple password schemes and physical control of network resources were enough to provide reasonable security So long as users need physical access to computers and network resources, good building security and simple password schemes are often safe enough.