What it means
Authentication checks evidence associated with a claimed identity. A password, a security key, a passkey, or a certificate can be part of that evidence, depending on the system. Successful authentication establishes a level of confidence in control of the required authenticator; it does not eliminate the possibility of credential theft or misuse.
This is separate from authorization, which decides what the requester may do. It is also separate from identity proofing, which establishes a claimed real-world identity during enrollment. A secure design covers the full authenticator lifecycle: enrollment, routine use, replacement, recovery, and revocation.
AN ILLUSTRATIVE SCENARIO
An accounting firm portal
An accounting firm enables a stronger sign-in method for staff accessing client files. The team verifies how staff enroll an authenticator, what happens when a device is lost, and whether older sign-in paths bypass the new requirement. A successful sign-in still grants only the user's approved client access. During an investigation, the analyst reports that the account completed authentication, then checks device and activity evidence before asserting that its assigned employee performed the action.
Put it to work
- Identify the identity being claimed, the authenticator being checked, and the service responsible for verifying it; include alternate sign-in paths.
- Choose authentication appropriate to the risk, including phishing-resistant methods where available, and protect enrollment and recovery from weaker shortcuts.
- Test normal sign-in, invalid credentials, lost authenticators, and revocation using test accounts; ensure useful logs avoid exposing authentication secrets.
How to check your work
Demonstrate that the required authenticator is checked on every applicable sign-in path and that revoked credentials no longer work. Check authorization separately, including attempts to access another test user's records.
Connect the ideas
- Identity
The record an organization uses for a person, device, or workload that can be authenticated.
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
- MFA
Authentication that requires more than one factor, such as something you know plus something you have.
- Account recovery
The process that restores access when authenticators are lost, which can become the weakest authenticator.