Authorization Techniques

Authorization techniques ,
control, and audit

Reported by:
Kyle Christian Albarico
Remial Garcia Busa
Authorization
Authorization is the function of specifying access rights/privileges to

resources, which is related to general information security and
computer security, and to access control in particular.
Authorization vs. Authentication
• Authorization - occurs after a system has successfully verified the
identity of an entity. The system will then allow access to resources
such as information, files, databases, or specific operations and
capabilities. After a system authenticates a user, authorization verifies
access to the required resources. It is the process of determining
whether an authenticated user can access a particular resource or
perform a specific action.
• Authentication - is essentially verifying the true identity of an entity. It

enables access control by proving that a user’s credentials match those
in an authorized user’s database. Identity verification can ensure
system security, process security, and corporate information security.
Basic Function
• Authorization - identifies if users or other entities are who they say they
are
• Authentication - determines if a user or entity is allowed to access a
particular asset
How it Works
• Authorization - identifies if users or other entities are who they say they
are
• Authentication - determines if a user or entity is allowed to access a
particular asset
Factors used in Authentication
• Knowledge factors—“something the user knows.” These factors include

passwords, access codes, personal identification numbers (PIN). These factors are
considered to be the least secure, because attackers can easily compromise them.
• Possession factors—“something the user has.” These factors include physical
identity documents, keys, hardware access tokens, mobile phones, digital
certificates, software tokens, or anything else a user or entity possesses that
proves their identity.
• Inherence Factors—“something the user is.” These factors include face images,
live video of a user, fingerprint scans, or any other biometric reading. Many
consider inherence factors to be the most secure, but sophisticated attackers can
compromise them by faking biometric readings.
Permissions used in Authorization
• Role-based permissions—grants permissions based on a group of users with a shared

business role. Role-based permissions specify which resources that group is allowed to
access. This permissions model supports the least privilege access principle, which states
that a system should grant each user the minimal resources they need to perform their
business role.
• Device permissions—grants permissions based on the device that is accessing the resource.
This permission model might grant different permissions for trusted devices such as a
corporate laptop, or non-trusted devices such as a personal mobile device. Authorization
systems should adjust device permissions based on an evaluation of each device’s security
posture.
• Location permissions—grants permissions based on the user or entity’s location.
Authorization systems use this type of permission to limit access to sensitive resources for
users connecting from home or other entities connecting remotely.
Methods used in Authorization
• Discretionary Access Control (DAC)‍– DAC determines privileges

depending on the specific user and their access groups. A DAC model
allows every object in a system to be accessed by a particular group
or identity. Those in charge of granting authorization can provide
admin permission to other users.
• Mandatory Access Control (MAC) – MAC determines authorization of
entities at the operating system level. MAC commonly governs
permissions for threads and processes, defining which files and
memory objects they can access.
Methods used in Authorization

• Role-Based Access Control (RBAC) – RBAC is used to enforce access
controls defined in the DAC or MAC model. RBAC builds on predefined
roles and privileges, assigns users to roles, and configures a system so
that only specific roles can access each object.
• Attribute-based Access Control (ABAC) – ABAC is used to enforce
access controls in a policy-based manner. It uses attributes, which can
be attached to a user, a resource, an object, or an entire environment.
An entity is authorized if the authentication system finds that all the
attributes defined in the policy are true.
Methods used in Authentication

• Passwords—considered “old school” and less secure but are still
commonly used in almost all authentication schemes.
• One-time Password (OTP)‍—grants a user or device one-time access
to a system. Authentication systems can deliver an OTP via email, text
message, or a physical access token.
• Token authentication—grants access to a user or device based on an
access token they possess. The token can be a hardware device or a
software token passed to their browser from an identity provider.
Learn more in our detailed guide to Token-Based Authentication.

• Single Sign-on (SSO)‍—enables login to multiple applications via a
central identity provider. The identity provider can be a service with a
large user base, such as Google or Facebook, or an organizational
identity provider, such as Active Directory. Learn more in our detailed
guide to SSO Authentication.
• Biometric authentication—uses an inherence factor, such as the
user’s face or fingerprint to identify them. There are increasingly
sophisticated ways to compare a photo or scan of a person’s biological
traits with a database of known identities.
• Multi-Factor Authentication (MFA)‍– This methodology combines

multiple forms of authentication to improve security. Typically, an
MFA scheme will augment passwords with token-based
authentication, OTP, biometric authentication, or several of these.
• Passwordless authentication – This is basically a variation on MFA,
which uses two authentication factors including fingerprints, magic
links, or OTAs to authenticate users without a password.
4 Types of Authorization
4 Types of Authorization
The four types of Authorization
• API keys
• Basic Auth
• HMAC
• OAuth
API Keys
In order to utilize most APIs, you must first sign up for an API key.
The API key is a long string that is typically included in the request URL
or header. The API key is mostly used to identify the person who is
performing the API call (authenticating you to use the API). The API key
could potentially be linked to a specific app you’ve registered. You may
receive both public and private keys from APIs. The public key is
normally included in the request, whereas the private key is used
primarily for server-to-server communication and is treated more like a
password. When you log in to some API documentation sites, your API
key is automatically supplied into the sample code and API Explorer.
Basic Auth
Basic Auth is another type of authorization. The sender inserts a username:
password into the request header using this way. Base64 is an encoding
technique that turns the login and password into a set of 64 characters to
ensure secure transmission. APIs that support Basic Auth will also support
HTTPS, which encrypts the message content within the HTTP transport protocol.
(Without HTTPS, hackers could easily decipher the username and password.)
The API server decrypts the message and checks the header when it receives it.
It chooses whether to accept or refuse the request after decoding the string and
assessing the username and password. HTTP Basic authentication (BA)
implementation is the simplest technique for enforcing access controls to web
resources because it does not require cookies, session identifiers, or login pages;
rather, HTTP Basic authentication uses standard fields in the HTTP header.
HMAC
HMAC stands for Hash-based Message Authentication Code. It is a
digital signature algorithm designed to reuse the message digest
Algorithm like MD5 and SHA-1 and provide an efficient data integrity
protocol mechanism. As HMAC is used to encrypt the plain text in a
secure manner, it is being used in Secure Socket Layer protocol, SSL
certificate and has been chosen as a mandatory security
implementation for the internet protocol, i.e. IP. There are 7 steps
involved in the Hash-based Message Authentication Code.
HMAC
Step 1: Make the length of the symmetric key equal to several bits in each block.
Step 2: XOR symmetric with a pad.
Step 3: Append the original message to S1.
Step 4: Apply the message-digest algorithm.
Step 5: XOR symmetric key with a pad.
Step 6: Append H to S2.
Step 7: Message digest algorithm.
HMAC
The important point is that only the sender and receiver have access to the
secret key (which is required to reconstruct the hash). The request does not include
the secret key. When you want to make sure a request is both authentic and hasn’t
been tampered with, you use HMAC security.
OAuth
Another type of authorization is OAuth, open access delegation standard that
allows Internet users to grant websites or applications access to their information
on other websites without having to give them their passwords. Companies like
Amazon, Google, Facebook, Microsoft, and Twitter employ this technology to let
users to exchange information about their accounts with third-party applications
or websites. On behalf of a resource owner, OAuth grants clients “secure
delegated access” to server resources. It outlines how resource owners can grant
third-party access to their server resources without having to provide credentials.
OAuth is a protocol that allows an authorization server to provide access tokens to
third-party clients with the permission of the resource owner. It was created
expressly for use with the Hypertext Transfer Protocol (HTTP). The third party then
uses the access token to gain access to the resource server’s protected resources.

Authorization Techniques

Uploaded by

Copyright:

Available Formats

Authorization Techniques

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Authorization Techniques

Uploaded by

Copyright:

Available Formats

Authorization techniques ,

control, and audit

Authorization is the function of specifying access rights/privileges to

• Authentication - is essentially verifying the true identity of an entity. It

• Knowledge factors—“something the user knows.” These factors include

• Role-based permissions—grants permissions based on a group of users with a shared

Methods used in Authorization

• Discretionary Access Control (DAC)‍– DAC determines privileges

Methods used in Authorization

Methods used in Authentication

Methods used in Authentication

Methods used in Authentication

• Multi-Factor Authentication (MFA)‍– This methodology combines

The four types of Authorization

You might also like