Cloud Hosting

By Cassa Niedringhaus Posted February 6, 2020

Authentication (AuthN) and authorization (AuthZ) are industry terms that are sometimes confused or used interchangeably. Theyre also presented together in AAA (authentication, authorization, and accounting). However, theyre individual concepts with separate effects on organizational security.

Here, well cover how theyre defined and how to implement them in enterprises.

Authentication refers to identity: Its about verifying that a user is who they say they are.

Just as in the real world, where we might verify a persons identity by their facial features, we need measures to verify a users digital identity. A user can authenticate their identity with credentials such as a username and password, an SSH key, or biometrics.

Multi-factor authentication (MFA) strengthens the process by requiring a user to enter something they know (i.e. password) and something they have (i.e. time-based one-time token). That way, even if a password is compromised, an account is still protected by the TOTP, which is more difficult to compromise.

Newer methods of authentication, such as biometrics or hardware keys, still stem from the idea that users provide something they know and/or something they have to authenticate their identities.

There are many considerations for organizations as they decide how users will authenticate and whether that process should differ by resource such as requiring MFA for systems and SSH keys for cloud servers. They also need to ensure that verification happens over secure channels.

Authorization is an orthogonal concept to authentication: Its about privilege and verifying what resources a user is allowed to access after youve verified their identity.

Organizations should heed the concept of least privilege so users have access only to the resources and data they need to get their jobs done and nothing more.

In an enterprise, for example, employees in the engineering department would be granted access to a different set of resources than employees in the sales department. Furthermore, within individual resources, different users might be granted different access levels.

Authentication and authorization are (Read more...)

See the original post here:
Difference Between Authorization and Authentication - Security Boulevard