In this pocket guide, you’ll find essential information about main security controls. I will explain the concepts, risks, share real-world examples and some interesting, less obvious insights.
Idea
Authentication is verification of the identity of the party you communicate with. Please do not confuse with authorisation, which is verification of its privileges.
It allows you to distinguish between users, legitimate users and hackers. But not only users – the communicating party can also be a system.
When both parties authenticate each other – it is called mutual authentication. It is very common in IT.
Application examples
When you connect to your Internet Bank, the bank authenticates you via username and password, and you (your browser, to be precise) authenticate the bank via TLS certificate.
Risks
Without authentication, you’d have to trust the party is what it says it is. That trust is likely to be exploited by hackers. The hacker can pretend to be a legitimate user and gain unauthorised access to your resources.
Lack of authentication (or faulty authentication) to private resource is usually considered as “High” risk.
There are instances where authentication is not necessary. If you are hosting a public resource that you want anyone to access, then you don’t need authentication. One example is this site, which serves articles to unauthenticated users. Users, however, authenticate the site via TLS certificate.
Quirks
It is easy to overlook server authentication in client->server scenarios, because you are focussed on client authentication. However, cyber attackers can target clients via rogue server resources. Mutual authentication is an answer to that.
Further reading
Pocket Guide: Authentication – Passwords
Pocket Guide: Authentication – Certificates
Pocket Guide: Authentication – local, centralised and federated
Pocket Guide: Two-Factor Authentication
Please check out the map of cyber security controls below. It is simple yet awesome.
