Authentication

Authentication is the process of verifying that a user, device, application, or other entity is actually who or what it claims to be. Authentication takes place before access to a protected system or resource is granted and is one of the fundamental mechanisms of information security.

For example, when signing in to a corporate system, a user first provides an account identifier and then proves their identity using a password, one-time code, hardware key, or another method. Only after successful authentication can the system determine which actions the user is permitted to perform.

Authentication should be distinguished from identification and authorization. These are related but separate stages of access management.

How Does Authentication Work?

In simplified form, the process of accessing a system can be represented as follows:

Identification → Authentication → Authorization

During identification, a user tells the system who they are, for example by entering a username or email address.

During authentication, the system verifies the claimed identity. For example, the user enters the password associated with the specified account.

This is followed by authorization, when the system determines which resources and operations the authenticated user is allowed to access.

In other words, entering a username answers the question “Who are you?”, verifying a password answers “Can you prove it?”, and assigned permissions determine “What are you allowed to do?”

Authentication Factors

Authentication methods are commonly classified according to the type of information or object used to verify identity. The main authentication factors include:

• something the user knows — a password, PIN, or another secret;
• something the user has — a smartphone, hardware token, smart card, or security key;
• something the user is — biometric characteristics, such as a fingerprint or facial features recognized by the system.

For example, signing in to a corporate laptop with a password and a fingerprint combines two factors from different categories.

Security systems may also consider contextual information such as location, device, IP address, user behavior, and other risk signals. These can influence whether additional verification is required, although they are not always considered independent traditional authentication factors.

Single-Factor and Multi-Factor Authentication

Single-Factor Authentication (SFA) uses one factor for identity verification. The most common example is signing in with a password.

Multi-Factor Authentication (MFA) requires verification using two or more factors from different categories. For example, after entering a password, a user may also need to confirm the sign-in using a hardware security key or another possession factor.

MFA improves account security because compromising a single factor is not enough to authenticate successfully. If an attacker obtains a user’s password, they would still need the second factor.

Two-Factor Authentication (2FA) is a specific type of MFA that uses two different authentication factors.

What Authentication Methods Are Used?

The appropriate authentication mechanism depends on the type of system, level of risk, and user experience requirements.

Common authentication methods include:

• passwords and PINs;
• one-time passwords (OTPs);
• authenticator apps;
• hardware security keys;
• digital certificates;
• biometric authentication;
• passkeys.

For example, many companies protect access to administrative interfaces with a hardware security key, while a one-time code from an authenticator app is enough for internal portals.

Enterprise environments also use centralized identity systems and Single Sign-On (SSO) technologies. These allow users to authenticate with a trusted identity provider and then access multiple connected applications without entering separate credentials for each one.

Authentication and Passwordless Authentication

Authentication does not necessarily require a password. Passwordless authentication uses other mechanisms to verify identity, such as passkeys, hardware security keys, or certificates.

Modern authentication mechanisms can use cryptographic key pairs. The private key remains on the user’s device or within a protected authenticator, while the server receives cryptographic proof that the user possesses the key without the secret itself being transmitted.

This approach can reduce risks associated with password theft and reuse. Some passwordless technologies also provide greater resistance to phishing, although the actual level of protection depends on the specific protocol and implementation.

Authentication of Users, Devices, and Applications

Authentication is not limited to human users signing in to systems. In modern IT infrastructure, software components and devices must also verify identities when communicating with one another.

For example, one server may authenticate another using a certificate, an application may access an API using appropriate credentials, and a corporate network may authenticate a device before granting it access.

Reliable authentication is therefore an important part of Identity and Access Management (IAM) and is used in on-premises infrastructure, cloud platforms, web applications, VPNs, APIs, and Zero Trust architectures.

FAQ

🠔 Back to glossary