Authentication and authorization: What’s the difference?
- Sabrina Barkdoll
- Apr 22, 2024
- 2 min read
Often, the words authentication and authorization are used interchangeably, but they couldn’t be more different.
Let’s break them down!
Authentication: The key to your front door
Sometimes, it’s easier to think of cybersecurity in everyday terms.
One way to do this is to think in a way that an application is the same as a house.
If we continue with the house analogy, authentication is then the front door key. It’s what enables the user to access the application itself.
However, just because someone has access to the front door, doesn’t mean they should have access to everything inside the house.
This is where authorization comes in.
Authorization: Specific access for specific instances?
So, the user has managed to step through the front door thanks to authentication, but now what?
Can they enter the master bedroom?
What about the guest bedroom?
Can they use the stove?
These answers to these questions require authorization.
Once a user is authenticated and gains access to the application, they must now be authorized to see certain data.
If we think of it this way, it’s similar to how Google Docs works. When you share a document, you’re asked to give permission for the recipient to edit, comment, or simply just view.
This is a simplified version of authorization.
Working together, orchestrated for harmony
While authentication and authorization are two different things, it’s easy to see how they are used interchangeably because they work hand-in-hand.
Authentication gets the user into the application and authorization helps decide what the user can do with it, protecting critical data from unauthorized or inappropriate use.
Download our our white paper to learn how authorization meets your enterprise’s needs where authentication alone falls short, and how our Orchestrated Authorization solution can help get you where you need to be in your access control journey.
Comments