Authentication verifies a user, service, or hardware device before granting access to a resource or service. It establishes identity at each access point and supports protection against internal and external threats. section 7.1.1 section 7.1.5
Authentication mechanisms balance security, usability, and adoption:
- Passwords remain familiar and cost-effective but are vulnerable to theft, phishing, brute-force cracking, reuse, and weak choices. section 7.1.1
- Token-based authentication adds time-sensitive codes through hardware or software tokens; multi-factor authentication and two-factor authentication use this additional layer. section 7.1.1
- Context-aware MFA adapts to behavior, location, or device, improving the balance between security and user experience. section 7.1.1
- Biometrics use characteristics such as fingerprints, facial recognition, or retinal scans; passwordless technologies provide an emerging alternative. section 7.1.1
Authentication beyond individual users
A web service can authenticate an API call from another service with a token or certificate before returning sensitive information. Network-connected hardware can be checked through a MAC address or TPM chip to confirm that the device is authorized and uncompromised. section 7.1.5
Authentication performance becomes actionable when measured through success and failure rates, compromised-credential incidents, identity-validation audit findings, provisioning and de-provisioning time, and response time for authentication anomalies. section 7.1.10
Table 7.1 Stages of identity life cycle management
| Create user |
Assign access |
Provision identity |
Manage identity |
Offboard identity |
| Document roles and attributes. Align onboarding exceptions. |
Create an access matrix. Define attributes. Create a cadence of review. |
Understand the best route for each resource. Use SAML, SCIM, LDAP, agents, and APIs. Map attributes downstream. |
Define the standard method of access. Collaborate with department leaders. Log and document changes. |
Use a centralized directory. Schedule suspensions to revoke access. |
Identity life cycle management connects authentication with onboarding, access assignment, identity changes, review, and timely offboarding. section 7.1
