Authentication and authorisation are two separate steps in controlling access. Authentication confirms who someone, or something, is. Authorisation decides what that identity is allowed to do once it has been authenticated.

What is the difference between authentication and authorisation?

Authentication asks “who are you?” and comes first, through passwords, MFA, passkeys or certificates. A person signing in with a password and a code is authenticating.

Authorisation asks “what can you do?” and follows authentication, through roles, permissions and policies. A person who sees only the reports their role allows is being authorised.

What are the main authentication methods?

• Passwords: simple, but easy to steal or reuse.
• One-time codes and authenticator apps: add a second factor.
• Hardware keys and passkeys: resistant to phishing.
• Biometrics: tie access to a person, usually combined with a device.
• Certificates and tokens: used mostly for machines and services.

Multi-factor authentication (MFA) combines two or more proofs. Single sign-on (SSO) lets a person authenticate once and reach several applications.

How does MFA fit in?

MFA stops most attacks that rely on a stolen password alone. It does not cover every protocol or every account, and it verifies the login, not what follows it.

How is authorisation applied?

Through models such as role-based access control (RBAC), which grants rights by job function, attribute-based access control (ABAC), which uses attributes and context, and policy-based rules evaluated at each request. Conditional access adds device, location and risk.

What is a session and why does it matter?

After authentication the system issues a session or token that proves the identity for a period. If it is stolen, an attacker can use it without any password or MFA. Limiting its lifetime and watching for unusual use reduce the risk.

How do attackers abuse each step?

Against authentication they use phishing, credential stuffing and stolen sessions. Against authorisation they use privilege escalation, over-privileged accounts and misused service accounts. Many attacks pass the first step and then abuse the second, acting with whatever authorisation the account holds.

Why is strong authentication not enough?

It proves who is at the door. It does not show what they do inside. A stolen password, a hijacked session or a compromised account all authenticate successfully, and nothing in the login tells you what happens next.

Monitoring what an identity does, and comparing it with what is normal, is the layer that catches an attacker who passed authentication and stays within the account’s authorisation.

What are common mistakes?

• MFA gaps on privileged and service accounts.
• Permissions granted at onboarding that are never reviewed.
• Tokens and sessions that never expire.
• Shared accounts that cannot be traced to one person.
• Treating a successful login as proof that everything that follows is safe.

How do machines authenticate?

Services and applications authenticate too, with keys, tokens and certificates. They rarely use MFA, and their authorisation is often broad, so non-human identities need the same care as people.

What is passwordless authentication?

It replaces passwords with something harder to steal, such as passkeys or hardware keys. It removes a common attack path, but authorisation and behaviour still need attention.

How do they relate to zero trust?

Zero trust verifies every request instead of trusting the network. Both steps are evaluated continuously rather than once at the door.

How do you cover both steps?

Use MFA where practical, starting with privileged access, keep authorisation narrow with least privilege, limit session lifetime and monitor behaviour after login.

Sharelock covers both sides. Prevention reviews privileges and MFA gaps, and detection keeps watching after login, down to individual transactions and queries on critical applications.

‍