Identity is the new perimeter in modern security. Authentication establishes who a user is, and authorization determines what they are allowed to do. Multi-factor authentication strengthens authentication by requiring two or more independent factors drawn from three categories: something you know (like a password), something you have (like a token or phone), and something you are (biometric traits such as a fingerprint, face, or iris). Biometric authentication is increasingly common on consumer devices, but credentials can still be stolen, so additional layers of protection matter.
Federated identity and single sign-on systems let users log in once and access multiple applications. Single Sign-On (SSO) reduces password fatigue and phishing risk. Behind the scenes, standards such as OAuth (an open standard for delegated authorization), OpenID Connect (an authentication layer on top of OAuth 2.0), SAML (an XML-based standard for SSO), and JSON Web Tokens (JWTs) carry identity and authorization information between parties. Passwordless approaches are gaining ground: a passkey is a passwordless standard based on public-key cryptography, FIDO2 is the broader open authentication standard for passwordless login, U2F provides hardware-based second factors, and physical security keys like YubiKey or built-in hardware like a Trusted Platform Module (TPM) anchor credentials to devices.
Authorization itself is governed by access control models. Role-Based Access Control (RBAC) assigns permissions based on a user's role, while Attribute-Based Access Control (ABAC) makes decisions using attributes of the user, resource, and environment. Access Control Lists (ACLs) attach permissions directly to resources. Mandatory Access Control (MAC) enforces system-wide policies regardless of user choice, as in classified military systems, whereas Discretionary Access Control (DAC) lets owners decide who can access their resources. Privileged accounts require especially strong controls, addressed by Privileged Access Management (PAM), just-in-time access that grants elevated permissions only when needed and for limited durations, credential vaulting that stores and rotates secrets automatically, and broader secrets management for API keys and sensitive configuration, often supported by tools such as HashiCorp Vault.