Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The internet is rife with 'authentication vs. authorization'-type questions. I'm not asking that here. I'm wondering if there is some overarching term that encompasses both of these.

I've seen authentication referred to as 'identity management', and authorization referred to as 'access control'.

But even AWS didn't have a good term for both of these together, so it created IAM.

So again, if authentication is proving who (as a principal) you are, and authorization is about giving that authenticated principal access levels, then I'm looking for an umbrella security term that applies to both (hence, governing who can do what for a particular resource). Does this exist?!

share|improve this question
"Access control" covers both in my experience. – paj28 Jan 7 at 13:09
How about "Auth"? – OrangeDog Jan 7 at 18:18
Can you provide the context in which you'd use this term? – Ben Piper Jan 7 at 22:04
up vote 56 down vote accepted

According to CISSP study guide , access control include IAAA (Identification, Authentication, Authorization and Accountability).

So if you dont care about the rest then you can call Authentication and Authorization as Access control.


Identification : User_Name

Authentication : User_Name + Password ( in one factor auth , simple case)

Authorization : Access to resources once authenticated

Accounting : Tracking who did what

share|improve this answer
All these answers are great and pretty much say the same thing. I'm marking this as the 'Accepted' answer because it both cites a credible source (CISSP) and provides a single term (Access Control) as an answer. – smeeb Jan 7 at 13:33
Not to be confused with the IAAAA (International Association Against Acronym Abuse) – inquisitiveIdiot Jan 8 at 22:36
good to see you ijaz khan ;) we spent some time in pieas – 3nigma Jun 4 at 14:16

I would say the closest thing I can think of is Authentication, Authorization, and Accounting framework, often abbreviated to AAA.

Authentication, authorization, and accounting (AAA) is a term for a framework for intelligently controlling access to computer resources, enforcing policies, auditing usage, and providing the information necessary to bill for services. These combined processes are considered important for effective network management and security.

share|improve this answer

The only term that springs to mind as governing both is 'Access Management' With that I mean a system that implements Authentication, Authorization and Accounting. (often called an AAA framework)

These terms do not really share a commonality until you start implementing a system that requires them.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.