Quantcast



Docs


Blogs


Forums


Samples


Media


Labs


Resources

 




DevCentral > Weblogs > Joe Pruitt - A Software Architect's take on Network Security
 The Networking ABC's - A is for Auth
posted on Monday, March 31, 2008 1:59 PM

abc

I was digging through some ideas for blog posts and with the popularity of the "101" series of tech tips we've done on DevCentral, I figured test the waters with some structure like that on my blog.  So, here's a go at the first of (at least) 26 posts on "The Networking ABCs".  Who knows, maybe someone will invent a new letter by the time I get to "Z". 

"A" is for Auth

Since the term "Auth" is used freely to mean one or both of the following terms, you'll get a bonus for this first entry!

SecureIDCard

Authentication

Pronounced: au-then-ti-ca-tion
Abbreviations: AuthN, 4v7#/\/

Authentication is the the process of verifying a user's identity, primarily when he/she is attempting to access some resources across a network.  This can be in the form of logging into a website or trying to open a file across a network share.  Users can authenticate in many ways such as supplying a username and password or presenting more hardened credentials such as a client side certificate or a token from a encryption device such as a SecurID card.

ghetto_chicks

Authorization

Pronounced: au-thor-i-za-tion
Abbreviations: AuthZ, 4v7#2

Authorization is the process of identifying the level of access that an authenticated users has been granted.  This is essentially a list of what an authenticated users is allowed to do.  An example of this would be whether a specific user is allowed to edit a document on a specific file share.  It's an added bonus if you are lucky enough to have knife-wielding ducklings to protect you from the occasionally invading kitty.

 



Email This
  del.icio.us
      

Feedback


9/19/2008 10:41 AM
Gravatar Being a new blogger, I'm just catching up on my ABCs. =)

In the mainstream these two terms are often used interchangeably, or authentication is used to mean both verifying identity and making sure the user is allowed access to the requested resource. The latter is understandable, because for most people logging into something does both authentication and authorization in one step. You type in your username and password, and the system verifies that you are who you say you are because it assumes only you know your password and then checks an internal database to make sure you are allowed into this particular system. In the computer security field, however, they are very different things, and meshing them when talking seriously about the security of a system can lead to incomplete (and thus insecure) implementations of security policy.
Kris Plunkett
 Leave Feedback
Title  
Name  
Email
Url
Comments   
Please add 3 and 8 and type the answer here: