🔐Authentication

NEW

Also known as: Identity Verification, Access Verification

Process of verifying the identity of a user, device, or process before granting access to resources.

DESCRIPTION

Authentication proves identity through credentials like passwords, tokens, certificates, or biometrics. Strong implementations combine factors (MFA), secure storage (hashing), and protocols such as OIDC and SAML. It differs from authorization, which determines permissions after identity is verified. Modern approaches favor passwordless authentication and risk-based checks. Zero trust architectures enforce continuous verification across sessions and networks.

ALTERNATIVE DEFINITIONS

NIST Glossary

The process of verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system.

Includes prerequisite nature before resource access.

Source

OWASP

Authentication is the process of verifying that a person or entity is who they claim to be.

Developer-focused guidance on secure implementation.

Source

IETF RFC 4949

Authentication: The process of verifying an identity claimed by or for a system entity.

Formal, protocol-neutral security glossary definition.

Source

RELATED TERMS

Identity Single Sign-On OAuth 2.0 OpenID Connect Multi-Factor Authentication IAM Certificate Passwordless Authentication Zero Trust

COMPETING TERMS

Authorization Identification

RELATIONS

• Narrower: Enterprise Authentication Multi-Factor Authentication Passwordless Authentication

KNOWLEDGE AREAS

Data Security Infrastructure Software Engineering

TARGET AUDIENCE

Software Developer DevOps Engineer Cloud Architect Chief Information Officer

EXTERNAL SOURCES

• Wikipedia - Authentication
• NIST SP 800-63-3 - Digital identity guidelines
• Auth0 - Auth vs. authZ fundamentals
• Okta - Authentication overview and patterns

TOP QUESTIONS

What is the difference between Authentication and Authorization?

Authentication verifies identity; authorization decides what an authenticated entity can do. They are complementary but distinct controls.

Category: Misunderstanding

What makes Authentication strong?

Multi-factor mechanisms, secure credential storage, phishing-resistant methods (FIDO2), and continuous verification enhance strength.

Category: BestPractice

What risks are common in Authentication systems?

Credential stuffing, phishing, and weak password policies. Misconfigured sessions and insecure token storage increase exposure.

Category: Risks

How does Zero Trust affect Authentication?

It requires continuous, context-aware verification beyond initial login, reducing implicit trust in networks.

Category: Topic

What protocols support modern Authentication?

OpenID Connect for web and mobile, SAML for enterprise SSO, and mutual TLS for service identity.

Category: Example

How to implement secure password handling?

Use salted, adaptive hashing (bcrypt/Argon2), enforce strong policies, and monitor for breached credentials.

Category: BestPractice

What is passwordless Authentication?

It replaces passwords with biometrics, security keys, or device-bound credentials, improving usability and security.

Category: Definition

How should Authentication be monitored?

Track login success/failure rates, anomalies, and suspicious patterns. Integrate with SIEM for alerting.

Category: Observability

What is a common misunderstanding about MFA?

Assuming any second factor is equal; SMS is weaker than app-based TOTP or FIDO2 security keys.

Category: Misunderstanding