The answer to your question depends on the context the terms are used. At the highest level of abstraction, the overarching term is Information Assurance where the 5 pillars are:
- Availability
- Integrity
- Authentication
- Confidentiality
- Non-repudiation
To be clear, authentication and authorisation are an aspect of Information Security. Which aims to enforce, with a high degree of confidence, the pillars of Information Assurance particularly non-repudiation.
So to delve further, both terms fall within Information Assurance and by association, the Information Security space. primarily in:
- Identity Management (IdM) or
- Identity and Access Management (IdAM)
IAM is the more common term especially if you work in government or large Enterprises where you would typically find 10000+ identities. For your interest, check out the latest Department of Defence (US) and the National Cyber Security Centres' (UK) directives and guidelines here and here respectively.
Definitions and Explanations
Identity and access management (IdAM) is an aspect of information security and encompasses technologies and processes including the two terms in your question.
Identity Governance - is a process in IdAM. It is the management of policies which govern:
- the end-to-end lifecycle (creation/change/move/end-of-life) of identities (Human/Machine/Artificial) across heterogeneous systems.
- the hierarchy of access to organisational assets that will be granted to established identities (of course commensurate with their role and responsibilities to the enterprise).
- compliance with the external/internal regulations such as ISO 27001, GDPR, HIPAA.
There are other functions but those 3 are the major ones I believe. In this practice, you are creating an identity such as say, a network frequency administrator, and determining which privileges that identity should have. You can also go as far as determining what areas of a building, which computers, which printers, which mobile device that identity can use, or even lock down device groups to a specific identity type. This in effect is the managed planning of authorisation to be associated with an identity. You will find your business analysts, enterprise architects, compliance specialist, information security specialists, and information auditors playing at this level of the game.
Access Management - Is the analysis and response to
- violations to access rules - which identity is violating its assigned access policy?
- access risks, specifically profiling and mitigation thereof of those risks - what is the extent of this violation and how do we respond to it? Does it need further analysis? Should these be catalogued and added to known attack vectors etc.
- real-time provisioning needs - Is the access available? that is to say is access to assets timely? No good granting access to an asset 5 days overdue.
As you can see, access control is closely tied to governance because appropriate access (from a technical implementation perspective of information assurance) is derived from the policies that (rather which should) have already been established by the Identity Governance authority within the Enterprise. In this practice, the focus is the technical implementation of authentication services to determine with a high degree of confidence that an identity is whom they claim to be and that they comply with the dictates of the policies set. You will find your cybersecurity specialists, incident and response analysts, infrastructure (network/storage/database) specialists, pen-testers, platform specialist, software specialists and analytic AI playing at this level.
It is improper to view authorisation and authentication in isolation, instead, recognise that they are terms used broadly within information assurance and information security.
Authorized
include the meaning ofAuthenticated
?Auth
- it's then ambiguous if you meanAuthentication
,Authorization
orboth
unless you always always always use full terms; re: "doesn't Authz include Authn?" - not always, because e.g. I canREAD
a StackOverflow page (authorized
) even when not logged in (noauthentication
).