1 Why authorization matters: Securing access in a digital world

In 2013, poor access control practices led to one of the largest data breaches in history. Over a three-week period, hackers stole 40 million credit and debit card accounts from retail giant Target by exploiting the account of a heating, ventilation, and air conditioning (HVAC) contractor. The attack began with a phishing email that tricked an employee at the HVAC company into revealing their credentials. As a vendor, the HVAC company had legitimate access to Target’s systems for tasks such as billing and project tracking, but not to its payment infrastructure. Using the stolen credentials, the attackers infiltrated Target’s internal network and ultimately installed malware on point-of-sale systems to harvest customer data. The breach resulted in nearly $300 million in direct costs to Target, along with reputational damage that’s difficult to quantify.

1.1 Managing relationships through digital identity

1.2 Challenges with traditional approaches to authorization

1.2.1 Scalability

1.2.2 Flexibility

1.2.3 Maintainability

1.2.4 Inefficiency

1.2.5 Auditability

1.2.6 Security

1.2.7 Consistency and transparency

1.2.8 Dynamic authorization addresses these challenges

1.3 Authorization matters

1.3.1 Software as a Service

1.3.2 Zero-trust security models

1.3.3 The Internet of Things

1.3.4 Heightened regulatory environment

1.3.5 Artificial intelligence

1.4 Dynamic authorization: Policy as Code and Policy as Data

1.4.1 Policy as Code: Defining access logic in a programmable way

1.4.2 Policy as Data: Storing and managing access rules dynamically