In a time where fake identities and false information are rampant on the internet, it is important to ensure the identity of users and computers. Proving the identity of both the server and client builds trust within the network. This is where authentication comes in.
What is authentication
Authentication is the process of recognizing the identity of the user. It determines whether someone is who it says they are. In technology, authentication is used by servers to know who is accessing the information, while clients use it to prove that the server is the intended system. Through this, the security of systems and information is ensured.
How authentication works
The technology used in authentication controls system access by checking if the credential of the user matches the credentials recorded in the database of users or servers. Before someone can access information, they first have to prove their identity through providing unique login information. Otherwise, they will not be able to enter the system. Authentication can be done by employing various instruments, such as data, passwords, passcodes, or digital signatures.
What is the purpose of authentication?
Just as how we want to protect our properties against intruders by using keys, authentication allows us to protect our systems by preventing unauthenticated users from accessing information. Its main purpose is to validate whether someone or something is who or what they declare to be. Authentication can also lead to granting access.
One example is using your ATM PIN to access your bank account. One may have an ATM card, but without the PIN, they would not be able to withdraw money. Through authentication, systems can be secured.
What are the types of authentications?
Authentication has evolved through time. As cybercriminals are finding more ways to penetrate systems, various methods have been created to prevent the access of unauthenticated users. There are 5 common authentication types:
-
Password-based authentication
Passwords are considered the most common and basic method of authentication. It uses a string of letters, numbers, and special characters. Passwords are usually paired with usernames. This combination will be recorded, and future inputs of username and password must match with what is recorded by the system. However, given that this is the most common method, passwords are susceptible to cyberattacks such as phishing.
-
Multi-factor authentication
Multi-factor or MFA is a method of authentication that requires two or more independent methods to identify a user. Only when these separate methods are successful can the user access the system. An example would be code generation using a mobile phone and inputting a pre-set password.
-
Biometric authentication
This security process relies on the unique biological characteristics of an individual and is most useful in situations where physical access is required. Such examples are facial recognition, fingerprint scanners, eye scanners, and voice recognition.
-
Certificate-based authentication
Digital certificates serve as digital passports. They contain the identity of the user using a public key, and the server uses cryptographic methods to confirm if the private key provided by the user is correct and associated with the certificate.
-
Token-based authentication
This is a method where users enter their credentials once and receive a random token in exchange. This token can then be used to access systems in place of the credential, as this proves your identity has already been authenticated.
Which authentication method is the most secure?
While all authentication methods provide an additional layer of security to your systems, some methods remain more secure than others. Passwords may be the most used, however, they lack advanced protection methods, therefore, making them prone to cyberattacks.
Experts believe that the most secured authentication method is through biometrics and the use of cryptographic keys through certificate-based authentication, as the former is almost impossible to spoof, while the latter verifies the user’s identity through a secured and tested method.
What authentication method should I use?
There are various factors to consider in choosing the authentication methods your organization should use. This includes the risk profile of the business and the usability and convenience of the authentication method. Low-security authentication technology can result in data breaches, while highly complex methods can result in lost business. Thus, it is important to assess your business need before deciding on the authentication method.
Basic authentication vs OAuth
Many organizations have been upgrading their cybersecurity techniques in line with the increase and advancement of attacks. Microsoft has begun to shift from password-based basic authentication and will soon use OAuth 2.0 token-based Modern Authentication for better protection. Basic authentication employs a username and a password as the user’s credentials that are used to access their accounts. Various risks are present in this model. In instances where the connection is not secure, their credentials can be stolen and used by others. As multi-factor authentication is not set up, there are no additional safeguards against unauthorized account access.
On the other hand, modern authentication based on OAuth 2.0 uses tokens provided by identity providers that are considered more secure than passwords as they contain bits of information. In addition, modern authentication using tokens specify additional rules, such as an expiration date and application that can use the token, ensuring that the token would not be compromised.
Authentication and authorization
In most cases, successful authentication would lead to access to systems. However, there is an additional step before knowing what the user can access. This is known as authorization.
What is the difference between authentication and authorization?
Authentication and authorization may often be connected, but they are separate processes. In simple terms, authentication is the process of verifying the identity of the user or system.
Meanwhile, authorization is the process of verifying the entitlements of the user, specifically on which applications and data they can access. Authorization can differ by user, depending on the rules established.
Authentication and verification
Before authentication, it is first important to verify the identity of the individual. For instance, before opening an online bank account, documents such as valid IDs are needed. These are checked to ensure the data provided by the individual is accurate and is for themselves. After the identity is verified, the individual would need to input their credentials such as passwords to access their account. This is where authentication comes in.
Difference between authentication and verification
Identity verification links an individual to the information they provide. This ensures that the data provided is true and real, and can be linked to the specific individual.
Authentication, on the other hand, is necessary for the individual to be able to access systems. It checks the identity of the user against the information they know or have, such as one-time passwords, biometrics, or knowledge checks.
Authentication and encryption
There are multiple instances in the remote environment where sensitive information is sent. Authentication can protect data from access from unauthenticated users, but encryption provides an additional layer of security by transforming data to unreadable ciphertext. This can only be decrypted by the correct decryption key, preventing unintended recipients to gain access to confidential information. Encryption protects data from breaches during transit from server to client or vice versa.
Authentication in cyber security
In cyber security, authentication in computer systems means the assurance of a user’s identity before being able to access a network. This is considered the first line of cyber defence, confirming the digital identification of the user before granting access through authorization. There are various authentication protocols used in cyber security.
Authentication protocols in cyber security
Authentication protocols are computer system communication protocols used to securely transfer authenticated data between two parties. They are designated rules for interaction used by systems and servers to communicate. Commonly used authentication protocols are:
-
Password Authentication Protocol (PAP)
Considered the least secure protocol, PAP validates credentials provided in the system.
-
Shiva Password Authentication Protocol (SPAP)
Like PAP, SPAP also uses passwords. However, they are processed through a reversible encryption system that makes them more secure than plaintext passwords.
-
Challenge Handshake Authentication Protocol (CHAP)
The CHAP is considered as the industry standard communication protocol that uses the MD5 Hashing Scheme. There is a three-way exchange of ‘secret’ – first, the router sends a challenge to the remote host, and the remote host sends a response with an MD5 hash function. The router then matches against its expected response, and when it is a match, it establishes a handshake in the form of authenticated connection.
Authentication in information security
All organizations carry confidential data that can cause issues when delivered to the wrong hands. Authentication is considered one of the backbones of information security, making it possible to verify the identity of the user before granting access to systems. With different authentication methods available, it is important for your organization to choose the best fit in terms of security and convenience to protect all users and clients.
GlobalSign’s authentication solutions utilize digital certificates to protect your networks, data, and applications through PKI.
Secure your data, identity, systems, and networks through authentication. Speak with us today to learn more.
