Home › Resources › Authentication

Executive Summary

Authentication is the process of verifying that a user or system is who they claim to be before granting access. It is distinct from authorization, which decides what a verified identity is allowed to do. Because stolen or weak credentials are behind a large share of breaches, strong authentication, especially multi-factor authentication, is one of the highest-value controls an organization can deploy.

What It Is

Authentication answers the question, are you who you say you are. It relies on one or more factors: something you know such as a password, something you have such as a phone or hardware key, and something you are such as a fingerprint or face. Single-factor authentication uses one of these, while multi-factor authentication requires two or more from different categories, so a stolen password alone is not enough. Authentication also covers how a session is established and maintained after login, since a verified identity must be carried securely across subsequent requests without exposing the credentials again.

Why It Matters

Credentials are among the most attacked assets in security because they open the door to everything behind them. Phishing, password reuse, and automated guessing all target authentication, and a single compromised account can lead to a full breach. Strong authentication dramatically reduces this risk, which is why multi-factor authentication is one of the most consistently recommended controls. For professionals, understanding authentication is essential across development, operations, and governance, since weaknesses here undermine every other control that depends on knowing who is acting.

How It Works

At a conceptual level, authentication compares the credentials presented against a securely stored reference and confirms they match without ever exposing the stored secret. Passwords should never be stored in a recoverable form; they are stored using a strong, slow password hashing method with per-user salting so that a stolen store is hard to crack. Multi-factor authentication adds a second, independent factor so that a stolen password is not sufficient. After a successful login, the system issues a session identifier or token that must be protected, scoped, and expired appropriately. Additional measures such as rate limiting and lockouts slow guessing, and monitoring for unusual logins helps catch takeover attempts. Passwordless approaches based on strong cryptographic keys are increasingly used to remove the weakest link, the reusable password.

Architecture Diagram

Visual Workflow

Common Attacks

• Phishing that captures passwords and sometimes one-time codes
• Credential stuffing that reuses passwords leaked from other breaches
• Brute-force and password-spraying against weak or common passwords
• Session hijacking or fixation that steals or plants a session identifier
• Bypassing weak multi-factor methods or abusing insecure account recovery

Common Mistakes

• Storing passwords without a strong, slow, salted hashing method
• Relying on passwords alone without multi-factor authentication
• Allowing unlimited login attempts with no rate limiting or lockout
• Building account recovery weaker than the login it protects
• Leaking whether a username exists through different error messages

Best Practices

• Require multi-factor authentication, preferring phishing-resistant methods
• Store passwords with a strong, slow, salted password hashing function
• Support long passphrases and screen against known breached passwords
• Apply rate limiting, lockouts, and monitoring for suspicious logins
• Issue secure, scoped, expiring sessions and protect session identifiers
• Make account recovery as strong as the primary login path

Quick Checklist

• Multi-factor authentication available and enforced for sensitive access
• Passwords stored with a strong, slow, salted hashing method
• Screening against known breached passwords in place
• Rate limiting and account lockout configured
• Sessions secure, scoped, and expiring, with protected identifiers
• Account recovery reviewed to match login strength

Recommended Tools

Industry Standards

Career Relevance

Authentication is central to security engineers, identity and access management specialists, application security engineers, and penetration testers, who both build and test login systems. Developers must implement authentication and session handling correctly, and GRC and audit professionals assess whether authentication meets policy and standards. For the AI-Governance-Jobs.com audience, distinguishing authentication from authorization and explaining multi-factor is a common interview topic.

Interview Questions

• What is the difference between authentication and authorization?
• What are the three authentication factor categories, with an example of each?
• Why should passwords be stored with a slow, salted hashing function?
• Why is multi-factor authentication so effective against common attacks?
• What is credential stuffing, and how do you defend against it?

Related Certifications

Further Reading

• NIST SP 800-63 Digital Identity Guidelines
• OWASP Authentication Cheat Sheet
• CISA: Multi-Factor Authentication

FAQ