An explanation of authorization and authentication

An explanation of authorization and authentication

Can you give me a good explanation of authorization? I am particularly concerned about the request phase. Our Security Administrators are constantly questioned as to why someone needs authorization to logon on to an application. Users feel that as long as they are an employee for the company, no further authorization is required. I intuitively know the concept, but have failed miserably when dealing with non IT personnel.


    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

There are actually two things that we talk about, authorization and authentication.

Authentication is the process of determining that someone (or something) is who (or what) it claims to be.

Authorization is the process of determining that someone (or something) is allowed to do what it would like to do.

The two are frequently combined, but can be completely separated.

Here are some examples:

I log on to my computer and try to delete a file, which fails because I don't have permission. I have been authenticated to the system, but I am not authorized to delete that file.

My employee badge lets me through the front door, but not into all doors because while merely being authenticated as an employee authorizes me for the main parts of the building, it does not authorize me for all parts of the building.

The notion that being an employee of a company authorizes you for all access is simply nonsense. HR records, for example, are always under tight control. Company infrastructure, be it the server room or the boiler room, has restricted access.

I hope this helps.

For more information on this topic, visit these other SearchSecurity resources:
Best Web Links: Authentication/Access Control
News and Analysis: Authentication questions and answers
Tech Tip: Authentication


This was first published in April 2002