Authentication, Authorization & Access Control
Authentication (who you are) and Authorization (what you can do) form the bedrock of security. These controls determine who accesses systems, data, and functions. Weak auth mechanisms are the top attack vector\u2014over 80% of breaches involve stolen or weak credentials.
The Five Authentication Factors
True multi-factor authentication (MFA) requires two or more independent factors from different categories. Using two passwords isn\u2019t MFA\u2014same factor twice doesn\u2019t add security.
Something You Know
Examples:
Security Profile:
Weakest factor. Vulnerable to phishing, keyloggers, shoulder surfing, data breaches.
Best Practices:
- 12+ characters minimum
- Unique per site (password manager)
- No dictionary words or personal info
- Regular rotation (if breach suspected)
- Multi-factor compensates for weak passwords
Something You Have
Examples:
Security Profile:
Medium. Physical possession required. Vulnerable to theft, SIM swapping, or device compromise.
Best Practices:
- Use hardware security keys (U2F/FIDO2) over SMS
- Keep authenticator app on separate device from login
- Enable biometric lock on phone authenticator
- Backup codes stored securely offline
Something You Are
Examples:
Security Profile:
Strong but not infallible. Vulnerable to spoofing (fake fingerprints, photos, voice recordings). Liveness detection crucial.
Best Practices:
- Combine with other factors (MFA)
- Use multi-modal biometrics (fingerprint + face)
- Liveness detection (blink detection, pulse detection)
- Template storage in secure enclave (not transmitted)
Somewhere You Are
Examples:
Security Profile:
Contextual factor. Used for risk-based authentication, not standalone MFA.
Best Practices:
Something You Do
Examples:
Security Profile:
Continuous authentication. Passive and unobtrusive. Used for detecting session hijacking or account takeover.
Best Practices:
Important
Authentication Methodologies
From primitive passwords to advanced passkeys, authentication systems have evolved dramatically. Each method balances security, usability, and deployment complexity.
Password-Based Authentication
How it works: User enters username + password. Server hashes stored password (with salt) and compares to hash of input.
Vulnerabilities:
- Password reuse across sites
- Dictionary/brute force attacks
- Phishing
- Keyloggers
- Shoulder surfing
- Database breach exposes hashes if unsalted or weak hash
Breach Example: LinkedIn (2012, disclosed 2016): 117 million password hashes stolen. 11 million were unsalted SHA-1 hashes cracked in days. Led to credential stuffing attacks on other sites.
Multi-Factor Authentication (MFA)
TOTP (Time-based OTP, RFC 6238): Google Authenticator, Authy, Push notifications: Duo, Microsoft Authenticator approve/deny, Hardware security keys: YubiKey (U2F/FIDO2), SMS OTP (weak, deprecated by NIST), Email OTP (weak, interceptible)How it works: Requires two or more independent factors: knowledge + possession, or possession + inherence. Eliminates single point of failure.
Breach Example: Twitter (2020): Social engineering of employees gave attacker access to internal tools, bypassing MFA. Demonstrated that MFA alone isn’t enough—need defense-in-depth.
Single Sign-On (SSO) & Federation
How it works: One identity provider (IdP) authenticates user once. Service providers (SPs) trust IdP. Uses protocols: SAML 2.0, OpenID Connect, OAuth 2.0.
Key Benefits:
- Reduced password fatigue
- Centralized access control and revocation
- Automated provisioning/deprovisioning
- Single audit trail
Risks:
- Single point of failure—IdP compromise gives access to all federated services
- Complex configuration errors
- Session hijacking across SPs
Breach Example: Okta (2022): Lapsus$ social-engineered Okta support to reset MFA for employee account. Access to Okta admin console gave access to 2,700+ customer environments including Breach, T-Mobile, and many others.
Certificate-Based Authentication
How it works: Client presents X.509 certificate signed by trusted CA. Server validates certificate chain. Used for machine-to-machine, VPNs, and high-assurance user auth.
Key Benefits:
- Cryptographically strong, phishing-resistant
- No passwords to steal
- Can be hardware-backed (TPM, TEE)
- Supports non-repudiation
Breach Example:
Passwordless Authentication
How it works: Eliminates passwords entirely. Uses FIDO2/WebAuthn: cryptographic key pair stored on authenticator (security key or platform authenticator like Windows Hello, Touch ID).
Breach Example:
Access Control Models: Managing Who Does What
Once authenticated, users need appropriate access to resources. Access control models define how permissions are structured and enforced. Modern systems use hybrid approaches combining multiple models.
Discretionary Access Control (DAC)
Resource owner decides who can access.Example:
Unix file permissions: owner rwx, group r-x, others r-x. Owner sets ACLs.
Pros:
- Flexible, decentralized, easy to understand
Cons:
- Owner mistakes propagate
- No central control
- Hard to audit at scale.
Mandatory Access Control (MAC)
System enforces policy based on security labels. Users cannot override.Example:
SELinux, AppArmor, Trusted Solaris. Mandatory compartmentalization in military/intel (Top Secret, Secret).
Pros:
- Centralized, non-bypassable
- Prevents privilege escalation.
Cons:
- Complex to configure
- Inflexible
- High administrative overhead.
Role-Based Access Control (RBAC)
Assign permissions to roles, users assigned to roles. “Least privilege” implementation.Example:
Active Directory: User → Role (Sales) → Permissions (read CRM, edit contacts). Separation of Duties (SoD) prevents conflicts.
Pros:
- Scalable, manageable, aligns with organizational structure, follows least privilege
Cons:
- Role explosion (thousands of roles)
- Static
- May not handle dynamic/contextual access.
Attribute-Based Access Control (ABAC)
Dynamic access decisions based on attributes of user, resource, environment, and action.Example:
Policy: “Allow access to financial reports IF user.department=Finance AND resource.sensitivity=Confidential AND time.business_hours”
Standard: XACML (eXtensible Access Control Markup Language) standard. Policies evaluated by Policy Decision Point (PDP).
Pros:
- Fine-grained, contextual (time, location, device), flexible
Cons:
- Complex policy management
- Hard to debug
- Performance overhead.
Policy-Based Access Control (PBAC)
Combines RBAC and ABAC with real-time policy engine.Example:
Google's BeyondCorp Zero Trust model: Access based on device health, user identity, and context—not network location.
Pros:
Cons:
Info
Session Management & Common Vulnerabilities
After authentication, session management maintains the authenticated state across multiple requests. Broken session management leads to account takeover.
Token Types
Session Tokens
Randomly generated unique identifier stored server-side (session store) and client-side (cookie).
JWT (JSON Web Token)
Self-contained token with payload (claims), signed with HMAC or RSA. No server-side session store needed.
Header.{Algorithm}.Payload.{Claims}.Signature
Session Vulnerabilities
Session Fixation
Attacker sets victim's session ID before login (via link or app vulnerability). Victim logs in, attacker uses same session ID to hijack authenticated session.
Fix:
Session Hijacking
Steal session cookie via XSS, packet sniffing (unencrypted HTTP), or side-channel. Attacker presents stolen cookie to impersonate user.
Session Expiry
Sessions must expire. Inactivity timeout (30 min), absolute timeout (8 hours). Refresh tokens for long-lived but revocable sessions.
Real-World Authentication & Access Control Failures
These incidents demonstrate the catastrophic impact of weak authentication and excessive privileges.
SolarWinds Supply Chain Compromise (2020)
Attackers compromised SolarWinds build system, inserted backdoor into Orion updates signed with legitimate certificate. Distributed to 18,000+ customers including US federal agencies.
Authentication/Authorization Failure: Default credentials in build server, excessive trust in code signing certificates without additional verification, lack of network segmentation between build and signing systems.
Lessons Learned:
- Implement code signing with hardware security modules (HSM)
- Enforce least privilege with zero standing access
- Multi-party approval for production releases
- Supply chain risk assessment mandatory
Twitter Bitcoin Scam (2020)
Attackers socially engineered Twitter employees using phone-based vishing, gained access to internal admin panel, posted fake Bitcoin giveaway from verified accounts (Obama, Musk, Gates).
Authentication/Authorization Failure: No MFA on admin panel for internal tools, weak internal verification processes for privileged access, lack of separation between support staff and production systems.
Lessons Learned:
- MFA mandatory for all admin access, especially privilege escalation
- Implement privilege access management (PAM)
- Segregation of duties—support cannot access production directly
- User behavior analytics to detect anomalous admin actions
Capital One Data Breach (2019)
Former AWS employee exploited misconfigured WAF rule to gain access to Capital One S3 bucket via SSRF vulnerability. Exposed 100M+ customer records.
Authentication/Authorization Failure: Overly permissive IAM role attached to web application firewall allowed SSRF to access internal metadata service, excessive privileges on S3 bucket (public read), no network segmentation between web and storage.
Lessons Learned:
- Principle of least privilege—IAM roles scoped to minimum required
- Defense in depth—WAF shouldn’t access internal metadata service
- Cloud security posture management (CSPM) to detect misconfigurations
- Network segmentation even in cloud
Zero Trust: Never Trust, Always Verify
Traditional perimeter security assumes everything inside the network is trusted. Zero Trust assumes breach and verifies every request, regardless of origin.
Zero Trust Core Principles
Verify Explicitly
Authenticate and authorize based on all available data points: identity, device health, location, service, data classification.
Use Least Privileged Access
Just-in-time and just-enough access. Limiting user access with Just-In-Time and Just-Enough-Access policies.
Assume Breach
Segment networks, use end-to-end encryption, monitor for anomalies. Treat every access request as potentially malicious.
Tip
Key Takeaways
- MFA is non-negotiable for any privileged or remote access. Blocks 99.9% of automated attacks.
- Passwords alone are broken. Credential stuffing, phishing, and breaches make password-only auth unacceptable.
- RBAC scales; ABAC contextualizes. RBAC for static roles, ABAC when access depends on dynamic attributes (time, location, risk).
- Least privilege lifecycle: access granted for specific duration, revoked when no longer needed. Not permanent entitlements.
- Session security: secure cookies (HttpOnly, Secure, SameSite), short timeouts, regeneration on privilege change.
- Zero Trust is the future: perimeter is everywhere, identity is the control plane, continuous verification replaces trust.
Further Reading & Resources
Comprehensive federal guidelines on authentication and lifecycle management including MFA requirements.
Practical guide to implementing secure authentication in applications, covering MFA, session management, password storage.
Open standards for passwordless authentication using public key cryptography and hardware authenticators.
Official NIST guidance on implementing Zero Trust principles across enterprise environments.