Authentication

Overview

Authentication confirms whether a person, device, service, or cryptographic account controls accepted evidence associated with an identity. Evidence can include knowledge factors, possession factors, biometrics, private-key signatures, certificates, or trusted workload credentials.

The process includes enrollment, credential issuance, login, challenge handling, session creation, recovery, revocation, and reauthentication for sensitive actions. Weakness in any stage can enable impersonation even when the primary credential or algorithm is strong.

Systems should use methods proportionate to risk, prefer phishing-resistant factors for privileged access, limit attempts, protect sessions, and monitor anomalies carefully. Authentication answers who the claimant appears to be, while authorization separately determines which resources and actions are allowed.

Authentication verifies a claimed identity or possession of an authenticator; it does not decide every action that the verified party is allowed to perform.

Authentication is the process of verifying a claimed identity before a system establishes a session or accepts protected activity. Authentication verifies identity evidence, but secure enrollment, recovery, sessions, and authorization remain necessary after a successful login.

For Authentication, the trust decision should establish the process of verifying a claimed identity before a system establishes a session or accepts protected activity and bind the result to the requested action and protected resource. Teams should test issuance, storage, validation, expiry, revocation, recovery, and privileged override for identity proof and credential state, rather than checking only a successful request. Logs concerning the identity check and identity proof and credential state should support investigation without exposing reusable secrets or unnecessary personal data.

Review of Authentication should compare permitted and rejected actions related to identity proof and credential state, confirm that recovery cannot bypass the primary safeguard, and remove obsolete access promptly.