Yes, they deliberately left the 'how' ambiguous to make Section 31 more powerful and mysterious.
Over the years, we've seen that the UFP seem to rely a lot on voiceprint and fingerprint identifications, coupled with sensors detection.
In many instances, we can hear the Captain or XO utter a sentence like 'Authorization Picard Alpha-Sigma-7-2-9'. Janeway does it to get control back of her ship in The Omega Directive (VOY S04E21), Picard does it to be able to read a message sent on a special frequency in Conspiracy (TNG S01E25), and so on.
In Hero Worship (TNG S05E11), we also learn a bit more about how computer panels recognize who is trying to use them, and how they prevent unauthorized acces:
TIMOTHY: My arm hit the computer panel. That's what destroyed the ship.
TROI: The ship was damaged when your arm hit the computer panel? Timothy, listen to me. The damage to your ship might have occurred at the same time your arm touched the panel, but it was only a coincidence. This wasn't your fault.
TIMOTHY: Yes it was.
DATA: It is not possible. The onboard control systems for every starship require a user code clearance. You could not have inadvertently affected any of the Vico's systems.
PICARD: Your computer had safety precautions. There is nothing you could have touched that would have damaged your ship.
And there are also the ever present sensors, both visual and auditive, that records basically everything that happens in a starship or facility and stores it all in triple redundant backups, as explained by O'Brien in Destiny (DS9 S03E15).
However, we are also told in no uncertain terms that Section 31 is everywhere within StarFleet and the Federation: Admiral Ross works with or for Sloan, they have at least one agent in the President's close entourage, and they seem to be able to move about the Federation as they wish and have access to whatever assets they need.
While it's never fully explained on screen, it doesn't seem too far-fetched to imagine that a secret organization with access to StarFleet's admiralty could give their field agents some high level access codes to UFP systems, high enough to allow them to bypass any kind of security and make sure that no record of their presence is ever created.