What is Authentication and Authorization?

March 1, 2024

Łukasz Ruzicki

Ensuring that only authorized individuals can access specific functions or information online is essential for security and privacy. This is where authentication and authorization play critical roles.

Authentication is the process of verifying an individual’s identity. In other words, it means confirming whether someone is indeed a user of a web application, a patient on a medical platform, a doctor, or a web page administrator. It’s about ensuring the person trying to gain access is genuinely who they claim to be.

Following authentication, authorization comes into play. It’s about determining what actions a verified individual is allowed to perform within a system. For example, it checks whether a person can add new products to an online shop, register a new user, or enroll an insuree in an insurance system. Authorization is all about setting boundaries on what authenticated users can and cannot do, thus safeguarding against unauthorized activities and ensuring a secure online experience for everyone.

Authentication and authorization mechanisms

When developing web applications, safeguarding your resources – whether data or functionalities – is essential to prevent unauthorized access or misuse. For instance, in an online shop, it’s critical to ensure that not just anyone can alter product prices. Without proper protection, a user might exploit this loophole to set items at zero cost and purchase them, leading to potential losses and security breaches.

To prevent such scenarios, applications utilize a variety of authentication and authorization mechanisms. These mechanisms are designed to verify users’ identities and control their access to specific functionalities. Here’s a brief overview of some common methods:

Password-based Authentication: The most basic form of authentication, where users log in with a username and a password.
Multi-factor Authentication (MFA): Adds an extra layer of security by requiring users to verify their identity using two or more factors, such as a password and a code sent to their phone.
Certificate-based Authentication: Uses digital certificates to authenticate a user or device, offering a higher level of security by relying on cryptographic techniques.
Biometric Authentication: Involves unique biological characteristics for authentication, such as fingerprints, facial recognition, or voice patterns.
Token-based Authentication: Provides users with a token after successfully logging in, which is then used to access protected resources without re-entering login credentials.

Each application may employ a different combination of these mechanisms, tailored to its specific security needs and user experience goals. While it’s crucial to keep security measures up-to-date to counteract new vulnerabilities, overcomplicating the authentication process can deter users from engaging with the application. Balancing security with usability is key to ensuring both effective protection and a positive user experience.

The importance of security testing

Understanding how to keep unauthorized people out of private digital areas is key. The necessity for robust security protocols is best illustrated by the real-life incidents where authentication and authorization mechanisms were breached, affecting many people and leading to critical losses. The following examples¹ expose different vulnerabilities that need to be considered when planning your security steps.

Ticketmaster (2020)

Ticketmaster faced charges for accessing a competitor’s computers without authorization by using stolen passwords, highlighting the risks associated with weak or compromised credentials.

SolarWinds (2020)

A supply chain attack on SolarWinds’ network monitoring software was partly attributed to an easily guessable password (“solarwinds123”), demonstrating the vulnerability created by poor password policies.

Microsoft Exchange (2021)

Hackers targeted on-premises servers running Microsoft Exchange email software using stolen passwords, among other methods, emphasizing the need for robust password management and vulnerability management practices.

Verkada (2021)

Hackers gained access to Verkada’s customer data, including security cameras, using an admin password found online, showcasing the dangers of mismanaged credentials and the lack of robust access control.

GoDaddy (2020)

Over a million WordPress customers’ accounts were compromised via a hacked password, underscoring the importance of secure password practices and the implementation of multi-factor authentication (MFA) to add an additional layer of security.

With the rapid advancement of technology, grasping the fundamentals of cybersecurity has become crucial for safeguarding against online vulnerabilities. Pentesting is vital for detecting these vulnerabilities. This process frequently utilizes the OWASP Checklist for web application testing, a comprehensive guide produced by the Open Web Application Security Project (OWASP). This checklist is essential for identifying potential weaknesses in web applications that might jeopardize their security and overall integrity.

As we delve into the specifics of this checklist, it becomes necessary to grasp the fundamental concepts of authentication and authorization – two areas often targeted by cybercriminals. These security measures are designed to protect systems and data from unauthorized access, yet they are also where vulnerabilities can be most exploitable.

Secure exchange of credentials

Ensuring encrypted credential exchange (SSL/TLS verification)

A fundamental aspect of secure web communication is the encrypted exchange of user credentials, highlighting the importance of SSL (Secure Sockets Layer) and TLS (Transport Layer Security) protocols. These are critical for maintaining a secure connection between a user’s browser and the server, encrypting data to protect it from eavesdroppers.

The risk of using HTTP

HTTP, unlike HTTPS, transmits data in plaintext, leaving it vulnerable to interception and attacks such as man-in-the-middle (MITM). This vulnerability exposes sensitive information, including credentials, to potential compromise.

SSL vs. TLS

Although SSL and TLS both secure data transmission, TLS is the updated, more effective version. It addresses vulnerabilities found in SSL protocols and offers enhanced encryption and security measures.

The importance of SSL/TLS verification

Validation: Verifying that a trusted Certificate Authority (CA) issues the certificate, ensuring it’s valid and corresponds to the website’s domain.
Expiration: Monitoring certificate validity to avoid using expired certificates, which could undermine user trust and website security.
Version: Using up-to-date TLS versions to protect against known attacks targeting older protocols.

Ensuring the encrypted exchange of credentials via SSL/TLS is more than a compliance requirement, it’s a critical measure for safeguarding user data and maintaining trust in web applications. By conducting regular SSL/TLS verifications, organizations can significantly reduce the risk of data breaches and strengthen their security framework.

Strengthening password security

Ensuring secure access through effective password policies is essential for protecting digital assets. This section focuses on evaluating password strength requirements and identifying vulnerabilities, including the issue of default credentials – pre-set passwords that can be easily exploited.

Default credentials and password strength during registration

Testing for default credentials involves checking for the use of preset passwords, which are often targeted by attackers using files of the most common passwords to break authorization.

The assessment of password strength during registration is crucial for preventing brute-force attacks, where attackers systematically check all possible passwords until the correct one is found. This includes examining the encryption methods used to secure passwords and recommending improvements such as longer passwords and requiring a variety of character types to enhance security.

Key recommendations are:

Complex password,
Unique password for different services,
Regular updates and variations,
Avoiding predictable information
Using password manager.

Assessing password change and lockout mechanisms

It’s important to see how well password changes or resets, and how the account lockouts after failed attempts are handled. These tests are all about making sure that the way users can change their passwords or get back into their accounts after forgetting their passwords is safe and doesn’t let hackers in easily.

Password change and reset

For the password change and reset part, the goal is to see if the process is secure. This means checking if the system uses things like secure tokens, which are hard to fake, to make sure that when a password is reset, it’s done in a way that’s as safe as asking for a password in the first place. It’s also about seeing if there’s a way to stop someone from trying to reset passwords over and over again to guess the right way in, which could let them break into an account.

At the same time, it’s important to make sure that trying to reset a password doesn’t give away whether or not an account exists, because that could give hackers clues on how to target specific users. And when a new password is created, the process needs to be tight so that the new password is strong and gets to the user safely without giving hackers a chance to snatch it.

Account lockout

For account lockout, the idea is to check if the system stops more login attempts after a few failures. This helps prevent hackers from trying endless combinations to guess a password. The test looks at how many attempts are allowed, for how long the account gets locked, and how a user can get back into their account safely if it gets locked. Adding something like a captcha is an extra step to tell humans and computers apart, but it doesn’t serve as the main defense because some captchas can be figured out by smart computer programs.

The whole point of these tests is to find weak spots where a hacker could get in, and to suggest ways to make these parts stronger. It’s about keeping user accounts safe from the common tricks hackers often use, without making things too complicated for the legitimate users.

Security questions strength

A key focus in increasing online platform security is the formulation and application of effective password recovery questions. This task centers on creating queries that are resilient against brute force attacks, efforts by attackers to guess answers through repeated trials, while being deeply personal and unique to the individual.

The aim is to devise questions that are straightforward for the user to respond to but challenging for everyone else, including close acquaintances or family, to figure out. This approach avoids questions based on easily accessible information or common knowledge, steering towards those grounded in the user’s personal experiences or background, which are unlikely for the outsiders to know.

The assessment process emphasizes the importance of designing questions that are neither overly simple nor predictable to those with access to public information or personal connections to the user. It includes thorough testing against brute force attack methodologies, often utilizing advanced software tools, to confirm the robustness of these security measures.

Finding that a platform does not incorporate such questions underscores the necessity of adopting alternative secure and user-friendly methods for password recovery, ensuring that while users can readily regain access to their accounts, the process remains impervious to unauthorized attempts.

Bypassing authentication

The evaluation of authentication mechanisms in cybersecurity audits aims to uncover vulnerabilities that might allow unauthorized access. This includes testing the ability to bypass authentication by directly accessing certain features, manipulating input data, guessing user session identifiers, and investigating the risk of SQL injection. SQL injection is a technique where attackers inject malicious code to manipulate the database and potentially access sensitive data.

Security audits often reveal critical vulnerabilities, such as the ability for users with elevated privileges to execute commands that can access sensitive data beyond their authorization, posing serious risks. Additionally, the predictability of session identifiers can allow attackers to hijack user sessions, undermining the security of user interactions.

Protecting against SQL injection is crucial since these attacks can manipulate the database to leak sensitive information, impacting user privacy and system integrity. The client-side management of data also presents challenges; if sensitive data like passwords and tokens are stored or handled insecurely before being securely saved, it can lead to unauthorized feature access. This highlights the necessity of prioritizing backend authorization over client-side authentication to safeguard against data manipulation and unauthorized access.

In essence, reinforcing frontend authorization, securing client-side data handling, and rigorously managing input parameters are vital for enhancing system security. Addressing these vulnerabilities is essential for maintaining a secure and trustworthy environment for users.

Browser cache and remember password

Web browsers often offer to remember our passwords and store lots of information to make our experience smoother. However, this convenience comes with risks, especially when sensitive information is involved. The focus here is on how important it is to manage this data correctly to keep it safe from unwanted access or cyber attacks.

Instead of letting browsers remember passwords or store sensitive data, it’s better to handle such information more securely, perhaps on the server side, where more robust security measures can be applied. This involves using special methods to check who is requesting access to information and ensuring that data is only available to those with the right permissions. Also, it’s crucial to protect against certain types of attacks that trick users into giving away their information or performing actions they didn’t intend to.

By following best practices for security, like not storing sensitive data in an easily accessible way and using secure settings for cookies, we can significantly reduce the risk. Additionally, when logging out, it’s important to ensure that sensitive data isn’t easily retrievable through the browser’s history or cache, adding another layer of protection against unauthorized access.

Authentication in alternative channels

Examining the strength and uniformity of authentication methods across different platforms, it’s worth highlighting the significance of implementing two-factor authentication (2FA). It adds an extra layer of security by requiring two different forms of identification from the user, typically, something they know (like a password) and something they have (such as a code sent to a mobile device).

Another important practice is evaluating the consistency of user interface designs for password reset functions and account creations. Differences in platform interfaces, while often subtle, can have far-reaching implications for user experience and potentially for the security framework underlying these platforms.

The goal is to assess the main authentication techniques used and their effectiveness in enhancing security across various user environments, such as on mobile and desktop platforms.

Object direct reference and path traversal

The security assessment is focused on identifying vulnerabilities exploitable via directory traversal. Its purpose is to identify unauthorized access risks regarding files/directories beyond the web server’s root. It involves the manipulation of variables linked to images, reports, and files that could allow attackers to access sensitive system files, threatening system integrity and confidentiality.

Modern tools enhance this security testing by overcoming browser limitations and using extensive lists for potential exploit points. Emphasizing strict file path parameter validation, the assessment highlights the critical need for rigorous input checks and secure configurations to mitigate directory traversal vulnerabilities, thus strengthening system security.

Authentication and authorization in openIMIS

Moving to a specific case, our work with openIMIS highlights our focus on robust authentication and authorization practices.

Within openIMIS, authentication verifies user identities through methods like password authentication. Subsequently, authorization protocols define and limit user actions based on their roles that are crucial for protecting sensitive data. This approach emphasizes our commitment to data privacy and integrity, ensuring openIMIS remains a secure platform for health financing management.