Authentication and Authorization

What it is

Authentication establishes who is making a claim (“prove you are this user”), while authorization establishes what that verified subject may do (“can this user read this record”). They are distinct steps that must not be conflated.

Why it matters

Most identity-based incidents are not failures of authentication alone — they are failures of authorization: tokens that are too long-lived, permissions that exceed least privilege, or missing checks on the authorization path. Treating them as one step leads to over-broad access and privilege escalation.

How it works

• Authentication factors: something you know (password), something you have (TOTP device), something you are (biometric). MFA combines factors.
• Authorization models: ACL, RBAC (role-based), ABAC (attribute/resource/policy-based) — evaluated against the authenticated principal.
• Session-bound authorization: the authorization decision is tied to an authenticated session/token (see security:http-sessions-cookies).

Detection

• Anomalous use of valid credentials (impossible travel, off-hours access).
• Sudden permission/profile changes without an authorized request.
• Multiple failed auth attempts followed by a successful login (credential stuffing / password spraying).

Mitigation

• Enable MFA on all privileged and customer-facing accounts (see security:identity-mfa).
• Enforce least privilege via role scoping; re-validate authorization on every request, never trust a client assertion alone.
• Bind authorization to short-lived sessions and revoke on termination or role change.
• Log auth success/failure and authorization-denied events for SOC review.

Investigation

For a suspected account-compromise or privilege-escalation event, collect: authentication logs, authorization decisions, session/token issuance, and the change history of the affected principal. Connect to the incident flow before containment.