Authentication v/s Authorization

Authentication and Authorization are often used together when it comes to gaining access to the system. However, both are very different concepts.

Authentication means confirming your own identity, while authorization means granting access to the system. In simple terms, authentication is the process of verifying who you are, while authorization is the process of verifying what you have access to.

Authentication

Authentication is usually done by a username and password, and sometimes along with other factors of authentication

Authentication factors determine the various elements the system uses to verify one’s identity. Example:

• what he knows:  includes passwords, PINs, combinations, code words, or secret handshakes.
• what he has: includes physical objects, such as keys, smart phones, smart cards, USB drives, and token devices.
• what he is: includes any part of the human body that can be offered for verification, such as fingerprints, palm scanning, facial recognition, retina scans, iris scans, and voice verification.

When it comes to security, at least two or all the three authentication factors must be verified in order to grant someone access to the system.

• Single-Factor Authentication – It’s the simplest authentication method which commonly relies on a simple password to grant user access to a particular system such as a website or a network. The person can request access to the system using only one of the credentials to verify his identity.
• Two-Factor Authentication – As the name suggests, it’s a two-step verification process which not only requires a username and password, but also something only the user knows, to ensure an additional level of security, such as an ATM pin. Using a username and password along with an additional piece of confidential information makes it virtually impossible for fraudsters to steal valuable data.
• Multi-Factor Authentication – It’s the most advanced method of authentication which uses two or more levels of security from independent categories of authentication to grant user access to the system. All the factors should be independent of each other to eliminate any vulnerability in the system. Financial organizations, banks, and law enforcement agencies use multiple-factor authentication to safeguard their data and applications from potential threats.

Authorization

Authorization, on the other hand, occurs after your identity is successfully authenticated by the system. It determines your ability to access the system and up to what extent. If the attempt is authenticated but not authorized, the system will deny access to the system.

For example, the process of verifying and confirming employees ID and passwords in an organization is called authentication, but determining which employee has access to which floor is called authorization.