Unit
- Authorization: The process of granting or denying specific permissions to authenticated users, systems, or processes. It determines what an entity can do within a system, such as reading a file, writing to a database, or executing a command.
- Authentication vs. Authorization: Authentication verifies identity (e.g., via password or biometric), while authorization defines access rights after identity is confirmed. Both are essential; authentication without authorization leaves systems exposed to misuse.
- Core components: Subjects (users, applications), objects (resources like files or APIs), and actions (read, write, delete). Authorization policies map subjects to permitted actions on objects.
- Access control models: Discretionary (owner-managed), mandatory (system-enforced), role-based, attribute-based, and policy-based. Each model addresses different security and operational needs.
- Principle of least privilege: Users should receive only the minimum permissions required to perform their job functions. This reduces the attack surface and limits potential damage from compromised accounts.
- Separation of duties: A security concept that prevents any single individual from having conflicting permissions that could enable fraud or error (e.g., creating and approving purchase orders). Authorization policies must enforce such segregation.
- Authorization in the enterprise: Modern organizations use centralized authorization systems (e.g., IAM platforms) to manage permissions across multiple applications, databases, and cloud services consistently.
- Regulatory impact: Regulations like GDPR, HIPAA, and SOX mandate strict authorization controls to protect sensitive data and ensure audit trails. Non-compliance can result in fines and reputational damage.
- Authorization policies and rules: Authorization policies are formal, machine readable rule sets that define access rights based on subject, resource, action, and environmental conditions. Properly structured policies prevent misconfiguration and privilege escalation by enforcing consistent, repeatable decisions. Policies must undergo version control and regular review to adapt to evolving business needs and security threats without introducing gaps.
- Centralized policy management (PDP/PEP): Modern authorization frameworks separate the Policy Decision Point (PDP) from the Policy Enforcement Point (PEP). The PDP evaluates access requests logically without executing the action, while the PEP intercepts user actions and enforces the decision. This architectural separation enables centralized policy updates, uniform enforcement across heterogeneous applications, and comprehensive audit logging for compliance.
- Attribute Based Access Control (ABAC): ABAC grants or denies access by evaluating attributes of the user, resource, action, and environment against policy rules. Unlike RBAC, it does not rely on static roles, enabling highly granular, context aware decisions, such as restricting access to sensitive financial records based on project assignment, clearance level, and network location simultaneously.
- Privileged Access Management (PAM): PAM is a critical authorization discipline focused on controlling and auditing administrative accounts with elevated permissions. PAM solutions enforce least privilege through just in time access elevation, automatic credential rotation, and session monitoring. Implementing PAM mitigates insider threats and satisfies regulatory requirements for stringent controls over sensitive system configurations and data.
Scope of Practice
Role: Authorization Management Specialist
Within scope:
- Defining and documenting authorization policies based on business requirements.
- Configuring access control lists (ACLs) and role definitions in IAM systems.
- Reviewing and approving access requests following least privilege principles.
- Conducting periodic access reviews and certifications.
- Collaborating with audit teams to provide authorization evidence.
Outside scope:
- Implementing encryption or network security controls beyond access permissions.
- Performing vulnerability assessments or penetration testing.
- Developing authentication mechanisms like single sign-on (SSO) systems.
- Managing physical security badges or facility access without IT integration.
- Making final decisions on regulatory interpretation without legal counsel.
Quick Revision
- Authorization controls what authenticated users can do, distinct from authentication which confirms identity.