Identify, Authenticate, Authorize: The Three Key Steps in Access Security

An engineer is starting her first day at a cybersecurity firm. What is the likelihood that she walks straight into the office without speaking to anyone, then begins accessing information from the nearest workstation?

In a far more plausible chain of events, the engineer would introduce herself and be identified on a staff list by security. She would then authenticate herself with a photo ID, or via a positive visual recognition from a trusted member of staff. The security guard would then authorize her to enter the office.

The three-step security process of identifying, authenticating, authorizing is common in our day-to-day lives, from catching a flight to signing into a business partner’s office. The same must be applied to IT infrastructure to ensure that individuals accessing corporate assets are who they say they are and have the proper authority to access them. Within an effective access security framework, these three stages work in tandem to keep the sensitive data in IT infrastructures safe.

Identification

Identity is the starting point of access security. In a virtual setting, the engineer from our analogy would be a user attempting to access an IT network. Just as the security guard required proof that the engineer was in fact who she claimed, a virtual system requires proof of identity. With so much sensitive data stored within an organization’s IT infrastructure, it is critical to be able to tell digital users apart with the same degree of accuracy as we can with physical identities.

When organizations deploy an identity management system, their primary goal is to properly, and with the highest level of confidence, identify each user wishing to connect into the corporate IT system. Users are given unique identifiers and are known by these personal credentials – their username and password – rather than by face or names on a paper list.

Simple credentials on their own are not sufficient to keep a network secure, as it leaves a system vulnerable to dishonest users laying claim to somebody else’s identity. Lost or stolen user credentials are all too common. Accurate, reliable identification of users is key to enforcing security policies and protecting data, and this is why we need to authenticate.

Authentication

Authentication is the stage in the security process where a user needs to prove their claimed identity. In our physical example, this would be where the engineer presented her photo ID to authenticate the identity she gave. Authenticating before allowing access to resources follows the Zero-Trust model of cybersecurity. Zero Trust means that identity and privileges are never assumed – they must always be verified through strict security protocols.

There are three types of authentication factors that can be used to verify a virtual identity:

• Something you know: The most common example of this type of information would be a password. A password is the most basic form of access security and one that is open to risks such as password sharing or visual hacking.
• Something you have: This could be a unique physical item such as a smartphone or an access card or a fob/RSA token that receives or generates a temporary passcode.
• Something you are: Biometric authentication factors can be used to confirm user identity via an inherent physical identifier such as an iris or fingerprint. Behavioral biometrics can also be used – for example, typing, voice, or signature recognition.

It’s harder for a hacker to steal two pieces of confidential information than one. Adding additional factors on top of a basic username/password combination, known as Multi-Factor Authentication (MFA), can provide an organization with a high level of certainty that the individual attempting access is truly who they claim to be. And this certainty is essential when accessing sensitive data.

Identity and Access Management Solutions such as WALLIX Trustelem offer organizations a way to intelligently authenticate and manage identities. The identity of users can be guaranteed through MFA, then controlled from a centralized dashboard in a process that is simple for administrators.

Once users within a network can be securely identified and authenticated, it’s equally important for them to have the appropriate authorizations.

Authorization

Can I go in here? Authorization answers this final question in the access security process. The security guard may have confirmed the engineer’s identity, but he would still only allow her into the cybersecurity firm – not the office next door. Even if a user’s digital identity can be authenticated by MFA, the Principle of Least Privilege means they should never be granted unrestricted access within an IT network. Weak authorization can lead to over-privileged users and the risk of accidental or deliberate abuse of root privileges. This in turn can leave a business open to the risk of fraud, data theft, and reputational damage.

Organizations that employ a robust Privileged Access Management (PAM) solution ensure that only authorized users can access sensitive resources at the right times. IT admins can centrally manage users and target systems, then set up authorization rules and conditions to automatically grant or deny access to critical resources. They can also monitor and record privileged users’ actions within a session for audit purposes or to terminate any suspicious activity in real-time.

A PAM solution such as the WALLIX Bastion offers a secure, streamlined way to authorize and monitor all privileged users within a business’s IT network. On top of managing users’ levels of privileged access, it allows an organization to:

• Eliminate the need for privileged users to have or require local system passwords
• Create an unalterable audit trail for any privileged operation
• Comply with access control, monitoring, and auditing regulations such as GDPR, NIS, ISO 27001, HIPAA, and PCI DSS.
• Integrate an Endpoint Privilege Management (EPM) solution such as WALLIX BestSafe to enforce the Principle of Least Privilege at an organization’s endpoint devices.

Identification, authentication, and authorization are all key aspects of a strong access security framework. They are employed together to secure access to a business’s network and keep sensitive information safe with a comprehensive, end-to-end approach to Access Security.

Discover a more in-depth overview of access security solutions, and the key concepts underlying them, by downloading our “Beginner’s Guide to Access Security” whitepaper.