Authentication
Field: Security · Also called: AuthN
Authentication is the security property of verifying that a user, process, or device is who or what it claims to be, and that it is authorized to access a given resource.
Authentication is one of the five CIANA properties. It is not part of the three-property CIA triad. The Committee on National Security Systems definition, as listed in the NIST glossary, describes authentication as including “a means of verifying an individual’s authorization to receive specific categories of information” (CNSSI 4009). Authentication and authorization are distinct in implementation, and many sources, including OWASP and FIPS 200, name them separately. Within the CIANA framework they form one property, and in web application security it includes authorization by necessity, as authentication without authorization leads to insecure direct object reference which is a broken access control failure under the OWASP Top 10.
NIST’s digital identity guidelines (SP 800-63) describe authentication in terms of a claimant proving possession and control of one or more authenticators, such as a password, a hardware security key, or a one-time code generator. Using more than one kind of authenticator is called multi-factor authentication.
Sources
- authentication, NIST Computer Security Resource Center Glossary. Retrieved September 24, 2026.
- FIPS 200, Minimum Security Requirements for Federal Information and Information Systems, NIST. Retrieved September 24, 2026.
- NIST SP 800-63-4, Digital Identity Guidelines, NIST. Retrieved September 24, 2026.
- Insecure Direct Object Reference (IDOR), OWASP Community. Retrieved September 24, 2026.