Authentication vs Authorization - Shon Harris book

TheFORCE

In the AIO 6th edition of the Shon Harris book page 203, on the paragraph about Authorization seems that there is an error. The paragraph ends with "Access criteria are the crux of authentication" shouldn't the word "authentication" actually be "authorization"? Or am i missing something here?

OfWolfAndMan

In the Infosec world, those words are two different things.

Authentication: Who are you, and how can you prove you're that person? (Username/Password, PKI, or other forms of authentication)
Authorization: What do you have access to as that user (i.e. customer = minimal rights, sys admin = access to remote desktop and remote server administration, network admin = access to network equipment, firewalls, load balancers)?

voodoo26

Authentication is the validation of your identity that user claim
Authorization is the access rights and resources that user is allowed to access and use

TheFORCE

I understand what authorization and what authentication is, my issue is with the sentence... "Access criteria are the crux of authentication" where i think it should be "Access criteria are the crux of authorization" instead. Correct?

broli720

I see where you may have issues with this. Definitely a tricky sentence.

aftereffector

I think you're right. Authorization makes more sense in that sentence.

5502george

Access criteria can be used for both...So yes and no.

TheFORCE

5502george wrote: »

Access criteria can be used for both...So yes and no.

How can access criteria be used for both? In order to access something, you need to be authenticated first. Also, just because you are authenticated to something, that automatically does not give you authorization aka access permissions to every resource in a system. Besides that, the entire paragraph is about authorization but the last sentence ends with authentication. I believe that might be an error in the book.

Spin Lock

TheFORCE wrote: »

"Access criteria are the crux of authentication" shouldn't the word "authentication" actually be "authorization"? Or am i missing something here?

No, you're not missing anything. I think you correctly caught a typo/error in AIO. Access criteria is exclusively related to authorization. I'm trying to think of a scenario where access criteria could be used during the authentication process, but I can't think of one nor could I find any information that describes such a link.

Cyberscum

TheFORCE wrote: »

How can access criteria be used for both? In order to access something, you need to be authenticated first. Also, just because you are authenticated to something, that automatically does not give you authorization aka access permissions to every resource in a system. Besides that, the entire paragraph is about authorization but the last sentence ends with authentication. I believe that might be an error in the book.

An NFC token can be used for access control and can also be used for authen.

5502george

^Location is an access criteria and can also be used to authenticate.

Spin Lock

5502george wrote: »

^Location is an access criteria and can also be used to authenticate.

Ah, yes. That makes sense. Thanks for pointing this out.

This is why I like folks posting technical questions on this forum - the discussions make you think in ways you might not have otherwise considered.

5502george

Spin Lock wrote: »

Ah, yes. That makes sense. Thanks for pointing this out.

This is why I like folks posting technical questions on this forum - the discussions make you think in ways you might not have otherwise considered.

I agree, but I think people studying for the test might get confused reading contradicting info. But there are always some interesting perspectives out there.

theFORCE: For the test the lines are very defined. In real life, and basically anything in IT, the lines are always blurred at best.

TheFORCE

Cyberscum wrote: »

An NFC token can be used for access control and can also be used for authen.

Location is an access criteria but it is not used for authentication. If there is an environment that uses location to autheticate. Then that environment is not very secure.

Cyberscum

^^Here something you can read and a "real world example" of how to implement BOTH authorization and authentication with one access criteria.

http://www.atgi.com/dist/Implementing%20Smart%20Card%20Authentication%20and%20Authorization%20with%20ASP.NET.pdf

...As far as your comment, well... try learning about location based authentication before saying its not secure.

JDMurray

Authentication is the verification of claimed identity factors, which are:

1. Something you know (e.g., password, PIN, pattern)
2. Something you have (e.g., badge, key, smartphone)
3. Something you are (e.g., biometrics)
4. Something you do (e.g., speaking, typing, handwriting, walking gait)
5. Someplace place you are (e.g., logging in from a specific terminal or GPS coordinates)

Once the identification credentials are verified to be authentic, authorization assigns access privileges to the identity based on:

1. The user's preferences (Discretionary Access Control)
2. The administrator's preferences (Mandatory Access Control)
3. The user's group preferences (Role Based Access Control)
4. Other access control factors (e.g., time of day, physical location)