Authentication vs. Authorization
What are authentication and authorization?
Authentication verifies the identity of a user or entity trying to access a system or resource. Authorization comes next and decides what the user or entity can do, granting or denying access to specific resources or functions based on their permissions, roles or privileges.
What is authentication?
Authentication is the first line of defense against unauthorized access and identity theft. Common authentication methods include passwords, biometrics, smart cards and passkeys. Multi-factor authentication (MFA) combines two or more types of factors, such as something you know (a password) and something you have (a smart card). Once authentication succeeds, the system has confidence that the user is who they claim to be. If it fails, the system denies access.
Authentication has its limits. Cyber criminals can steal or guess credentials through social engineering, phishing and brute force attacks, or exploit flaws in the authentication process itself. Strong authentication methods, such as phishing-resistant MFA, reduce that risk when they're kept up to date.
Authentication can be time-consuming in systems that require it often, such as online banking or e-commerce sites. Organizations can use single sign-on (SSO) so users can access multiple resources or systems with one set of credentials.
What is authorization?
Authorization controls limit users to the resources they are allowed to use and help prevent unauthorized access to, or changes to, sensitive data. Common authorization methods include role-based access control (RBAC), attribute-based access control (ABAC) and discretionary access control.
Authorization is a critical part of information security because it helps organizations maintain the confidentiality, integrity and availability of their resources and data. Effective authorization controls can be hard to implement in complex systems with many users and roles, so organizations need to design their authorization policies carefully and review them regularly to keep them aligned with their security and business objectives.
Authorization controls must be enforced at several levels, including the application, network and data layers. That takes a mix of technologies, such as Identity and Access Management (IAM) and Privileged Access Management (PAM) tools, directory groups, policy engines, database permissions and API gateways.
Key differences between authentication and authorization
Authentication and authorization work together, but they answer different questions and carry different risks.
| Authentication | Authorization | |
| Question it answers | Who are you? | What are you allowed to do? |
| When it happens | First | After authentication |
| What it checks | Credentials, such as a password, smart card or biometric factor | Permissions, roles or attributes defined in access control policies |
| Common methods | Passwords, biometrics, smart cards, passkeys and MFA | RBAC, ABAC and discretionary access control, where the resource owner decides who has access |
| How it works | Passwords are stored as salted hashes and checked by hashing the password that was entered | Policies grant or deny access based on roles or on attributes of the user, the resource and the environment, such as time or location |
| Main risks | Stolen or guessed credentials and authentication bypass attacks | Unauthorized access to, changes to or deletion of sensitive data |
| Example | Signing in to a bank account with a password and MFA | Making only the transactions the account type allows |
When authorization decisions are logged, they also create an audit trail of access events.
Examples of authentication and authorization
Most everyday sign-ins involve both steps:
- Online banking. Signing in with a password and MFA is authentication. Being able to make only the transactions the account type allows is authorization.
- Smartphones. Unlocking a phone with facial recognition is authentication. Granting or denying an app permission to use the camera or contacts is authorization.
- Airports. Showing a passport or government ID at the checkpoint is authentication. The boarding pass, which allows the traveler onto one particular flight, is authorization.
- Workplace access. Tapping a badge at a reader verifies who the employee is, which is authentication. The door opening only for employees whose role allows it is authorization.
- Email and cloud storage. Signing in with a username, password and MFA is authentication. Being able to open and edit only the files or folders a role permits is authorization.
- IT environments. An engineer signing in with SSO is authentication. Policies that decide which servers and databases the engineer can reach, and what they can do there, are authorization.
Why authentication and authorization matter
Authentication and authorization reduce risk in three areas:
- Protecting user data. Weak authentication lets cyber criminals exploit vulnerabilities to bypass it, then steal sensitive data or use it as an entry point for further cyberattacks. Weak authorization controls can lead to unauthorized access, changes or deletion, and to data loss.
- Protecting system integrity. Authorization controls such as least privilege can limit privilege escalation attacks, where a cyber criminal uses a compromised account to gain elevated privileges and reach restricted resources. Access logs show who accessed a system or resource and what they did, which helps teams spot security incidents and vulnerabilities early.
- Meeting compliance requirements. Authentication and authorization support compliance with regulations and standards such as HIPAA, PCI DSS and GDPR. HIPAA and PCI DSS require access controls and user authentication to protect sensitive data, and GDPR requires appropriate technical measures to protect personal data. Monitoring and reporting on access events helps show those controls work.
More resources
Blogs
What's the difference between authentication and authorization?
What is authorization and how does it work?
Single-factor authentication (SFA) vs. multi-factor authentication (MFA)