Overarching term for 'authentication' and 'authorization'?

Question

The internet is rife with 'authentication vs. authorization'-type questions. I'm not asking that here. I'm wondering if there is some overarching term that encompasses both of these.

I've seen authentication referred to as 'identity management', and authorization referred to as 'access control'.

But even AWS didn't have a good term for both of these together, so it created IAM.

So again, if authentication is proving who (as a principal) you are, and authorization is about giving that authenticated principal access levels, then I'm looking for an umbrella security term that applies to both (hence, governing who can do what for a particular resource). Does this exist?!

Answer 1

According to CISSP study guide , access control include IAAA (Identification, Authentication, Authorization and Accountability).

So if you dont care about the rest then you can call Authentication and Authorization as Access control.

Where:

Identification : User_Name

Authentication : User_Name + Password ( in one factor auth , simple case)

Authorization : Access to resources once authenticated

Accounting : Tracking who did what

Answer 2

I would say the closest thing I can think of is Authentication, Authorization, and Accounting framework, often abbreviated to AAA.

Authentication, authorization, and accounting (AAA) is a term for a framework for intelligently controlling access to computer resources, enforcing policies, auditing usage, and providing the information necessary to bill for services. These combined processes are considered important for effective network management and security.

Answer 3

The only term that springs to mind as governing both is 'Access Management' With that I mean a system that implements Authentication, Authorization and Accounting. (often called an AAA framework)

These terms do not really share a commonality until you start implementing a system that requires them.

Answer 4

Most analyst firms call this space Identity & Access Management (IAM). It is also the name of the space vendors use for their products. There is alongside IAM another space called IAG or Identity & Access Governance which is more about the review time whereas IAM is more aboutd definition and runtime.

Lastly, Gartner & Kuppinger Cole also use EAM (Externalized Authorization Management) and DAM (Dynamic Authorization Management) for the access control specifics.

Answer 5

The answer to your question depends on the context the terms are used. At the highest level of abstraction, the overarching term is Information Assurance where the 5 pillars are:

• Availability
• Integrity
• Authentication
• Confidentiality
• Non-repudiation

To be clear, authentication and authorisation are an aspect of Information Security. Which aims to enforce, with a high degree of confidence, the pillars of Information Assurance particularly non-repudiation.

So to delve further, both terms fall within Information Assurance and by association, the Information Security space. primarily in:

• Identity Management (IdM) or
• Identity and Access Management (IdAM)

IAM is the more common term especially if you work in government or large Enterprises where you would typically find 10000+ identities. For your interest, check out the latest Department of Defence (US) and the National Cyber Security Centres' (UK) directives and guidelines here and here respectively.

Definitions and Explanations

Identity and access management (IdAM) is an aspect of information security and encompasses technologies and processes including the two terms in your question.

Identity Governance - is a process in IdAM. It is the management of policies which govern:

• the end-to-end lifecycle (creation/change/move/end-of-life) of identities (Human/Machine/Artificial) across heterogeneous systems.
• the hierarchy of access to organisational assets that will be granted to established identities (of course commensurate with their role and responsibilities to the enterprise).
• compliance with the external/internal regulations such as ISO 27001, GDPR, HIPAA.

There are other functions but those 3 are the major ones I believe. In this practice, you are creating an identity such as say, a network frequency administrator, and determining which privileges that identity should have. You can also go as far as determining what areas of a building, which computers, which printers, which mobile device that identity can use, or even lock down device groups to a specific identity type. This in effect is the managed planning of authorisation to be associated with an identity. You will find your business analysts, enterprise architects, compliance specialist, information security specialists, and information auditors playing at this level of the game.

Access Management - Is the analysis and response to

• violations to access rules - which identity is violating its assigned access policy?
• access risks, specifically profiling and mitigation thereof of those risks - what is the extent of this violation and how do we respond to it? Does it need further analysis? Should these be catalogued and added to known attack vectors etc.
• real-time provisioning needs - Is the access available? that is to say is access to assets timely? No good granting access to an asset 5 days overdue.

As you can see, access control is closely tied to governance because appropriate access (from a technical implementation perspective of information assurance) is derived from the policies that (rather which should) have already been established by the Identity Governance authority within the Enterprise. In this practice, the focus is the technical implementation of authentication services to determine with a high degree of confidence that an identity is whom they claim to be and that they comply with the dictates of the policies set. You will find your cybersecurity specialists, incident and response analysts, infrastructure (network/storage/database) specialists, pen-testers, platform specialist, software specialists and analytic AI playing at this level.

It is improper to view authorisation and authentication in isolation, instead, recognise that they are terms used broadly within information assurance and information security.