49

The internet is rife with 'authentication vs. authorization'-type questions. I'm not asking that here. I'm wondering if there is some overarching term that encompasses both of these.

I've seen authentication referred to as 'identity management', and authorization referred to as 'access control'.

But even AWS didn't have a good term for both of these together, so it created IAM.

So again, if authentication is proving who (as a principal) you are, and authorization is about giving that authenticated principal access levels, then I'm looking for an umbrella security term that applies to both (hence, governing who can do what for a particular resource). Does this exist?!

5
  • 8
    "Access control" covers both in my experience.
    – paj28
    Jan 7, 2016 at 13:09
  • 5
    How about "Auth"?
    – OrangeDog
    Jan 7, 2016 at 18:18
  • Can you provide the context in which you'd use this term?
    – Ben
    Jan 7, 2016 at 22:04
  • doesn't Authorized include the meaning of Authenticated ?
    – T.Todua
    Oct 15, 2018 at 12:31
  • re: Auth - it's then ambiguous if you mean Authentication, Authorization or both unless you always always always use full terms; re: "doesn't Authz include Authn?" - not always, because e.g. I can READ a StackOverflow page (authorized) even when not logged in (no authentication).
    – dwanderson
    Feb 26, 2020 at 19:07

5 Answers 5

70

According to CISSP study guide , access control include IAAA (Identification, Authentication, Authorization and Accountability).

So if you dont care about the rest then you can call Authentication and Authorization as Access control.

Where:

Identification : User_Name

Authentication : User_Name + Password ( in one factor auth , simple case)

Authorization : Access to resources once authenticated

Accounting : Tracking who did what

2
  • 3
    All these answers are great and pretty much say the same thing. I'm marking this as the 'Accepted' answer because it both cites a credible source (CISSP) and provides a single term (Access Control) as an answer.
    – smeeb
    Jan 7, 2016 at 13:33
  • 7
    Not to be confused with the IAAAA (International Association Against Acronym Abuse) Jan 8, 2016 at 22:36
9

I would say the closest thing I can think of is Authentication, Authorization, and Accounting framework, often abbreviated to AAA.

Authentication, authorization, and accounting (AAA) is a term for a framework for intelligently controlling access to computer resources, enforcing policies, auditing usage, and providing the information necessary to bill for services. These combined processes are considered important for effective network management and security.

3

The only term that springs to mind as governing both is 'Access Management' With that I mean a system that implements Authentication, Authorization and Accounting. (often called an AAA framework)

These terms do not really share a commonality until you start implementing a system that requires them.

0

Most analyst firms call this space Identity & Access Management (IAM). It is also the name of the space vendors use for their products. There is alongside IAM another space called IAG or Identity & Access Governance which is more about the review time whereas IAM is more aboutd definition and runtime.

Lastly, Gartner & Kuppinger Cole also use EAM (Externalized Authorization Management) and DAM (Dynamic Authorization Management) for the access control specifics.

0

The answer to your question depends on the context the terms are used. At the highest level of abstraction, the overarching term is Information Assurance where the 5 pillars are:

  • Availability
  • Integrity
  • Authentication
  • Confidentiality
  • Non-repudiation

To be clear, authentication and authorisation are an aspect of Information Security. Which aims to enforce, with a high degree of confidence, the pillars of Information Assurance particularly non-repudiation.

So to delve further, both terms fall within Information Assurance and by association, the Information Security space. primarily in:

  • Identity Management (IdM) or
  • Identity and Access Management (IdAM)

IAM is the more common term especially if you work in government or large Enterprises where you would typically find 10000+ identities. For your interest, check out the latest Department of Defence (US) and the National Cyber Security Centres' (UK) directives and guidelines here and here respectively.

Definitions and Explanations

Identity and access management (IdAM) is an aspect of information security and encompasses technologies and processes including the two terms in your question.

Identity Governance - is a process in IdAM. It is the management of policies which govern:

  • the end-to-end lifecycle (creation/change/move/end-of-life) of identities (Human/Machine/Artificial) across heterogeneous systems.
  • the hierarchy of access to organisational assets that will be granted to established identities (of course commensurate with their role and responsibilities to the enterprise).
  • compliance with the external/internal regulations such as ISO 27001, GDPR, HIPAA.

There are other functions but those 3 are the major ones I believe. In this practice, you are creating an identity such as say, a network frequency administrator, and determining which privileges that identity should have. You can also go as far as determining what areas of a building, which computers, which printers, which mobile device that identity can use, or even lock down device groups to a specific identity type. This in effect is the managed planning of authorisation to be associated with an identity. You will find your business analysts, enterprise architects, compliance specialist, information security specialists, and information auditors playing at this level of the game.

Access Management - Is the analysis and response to

  • violations to access rules - which identity is violating its assigned access policy?
  • access risks, specifically profiling and mitigation thereof of those risks - what is the extent of this violation and how do we respond to it? Does it need further analysis? Should these be catalogued and added to known attack vectors etc.
  • real-time provisioning needs - Is the access available? that is to say is access to assets timely? No good granting access to an asset 5 days overdue.

As you can see, access control is closely tied to governance because appropriate access (from a technical implementation perspective of information assurance) is derived from the policies that (rather which should) have already been established by the Identity Governance authority within the Enterprise. In this practice, the focus is the technical implementation of authentication services to determine with a high degree of confidence that an identity is whom they claim to be and that they comply with the dictates of the policies set. You will find your cybersecurity specialists, incident and response analysts, infrastructure (network/storage/database) specialists, pen-testers, platform specialist, software specialists and analytic AI playing at this level.

It is improper to view authorisation and authentication in isolation, instead, recognise that they are terms used broadly within information assurance and information security.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .