TL;DR
Authorization is the security process that determines which digital resources a user can access after logging in. It begins with policy-setting by administrators, flows through authentication and database checks, and is enforced by access control systems. Understanding how authorization works — and how it differs from access control — is essential for protecting any organization's digital environment.
What is the formal definition of authorization?
Authorization is the process of matching users to the right digital assets. The work starts with policy.
A person with authority, such as a department head or IT manager, determines what access a person should have. They could define access rules by:
- Departments. Every person that works within a specific group has access to the same files.
- Titles. Access varies depending on the role a user plays within the company.
- Individuality. What a person can see depends on the work a person does, seniority within the company, or something else altogether.
Crafting rules like this takes time and expertise, and it's often work people with seniority tackle. People with system administrator jobs can enforce the policies. This job typically involves solving user problems, so adding to or removing file access may become part of everyday work.
How Does Authorization Work?
People gain access by following a series of predictable steps.
Authorization involves:
- Authentication. Organizations can manage authentication in a variety of ways. They can require a name/password combination to allow the system to verify a person's identity. Almost half of all companies add to this process with two-factor authentication steps, such as tapping in a one-time code sent to a cell phone. A simple step like this cuts down on fraud.
- Database checks. With authentication complete, the system knows who you are and what administrators believe you should use in your work.
- Access control. The system unlocks access to these assets, and the user can begin work.
Most people have used authorization processes before, even if they didn't know it. Major systems use authorization, including:
- Windows. Windows requires you to set up at least one authorized user, and a password protects your access.
- iTunes. You must authorize your computer to purchase items within the store.
- Your employer. Again, almost every corporate computer system out there requires users to log in and move through authorization before accessing files.
Computers are fast by design, and it often takes just seconds to complete this complex process. You may never know it's happening.
How does authorization differ from access control?
If authorization involves defining a policy, access control puts the policies to work. These two terms aren't interchangeable. But they do work hand in hand.
Once you've completed the authorization process, the system knows who you are and what you should see. The access control system unlocks the assets, so you can do the work you need to do.
| Authorization | Access Control |
|---|---|
| Defines the policy — what a user should be able to access. | Puts the policy to work — unlocks the assets for the user. |
| Involves authentication, database checks, and policy rules. | Executes after authorization is complete. |
How Okta can help
The more you know about how security systems work, the better you can protect your company and your coworkers from hackers and malignant actors.
At Okta, we work hard to define terms simply, so everyone can learn. And we build robust tools everyone needs to manage authorization, authentication, and access control. Learn more.
Frequently asked questions
What is the difference between authorization and authentication?
Authentication is the step that verifies who you are — typically through a username, password, or a two-factor code. Authorization comes after authentication and determines what digital resources you are permitted to access once your identity has been confirmed.
Who is responsible for setting authorization policies in an organization?
Authorization policies are typically defined by people in positions of authority, such as department heads or IT managers. System administrators then enforce those policies by managing user access on a day-to-day basis.
What are the main ways authorization rules can be structured?
Authorization rules can be organized by department (granting the same access to everyone in a group), by job title (varying access based on a user's role), or on an individual basis (tailoring access to a specific person's responsibilities or seniority).
How does access control relate to authorization?
Authorization defines the policy — it establishes what a user should be able to access. Access control is the mechanism that enforces that policy by actually unlocking the relevant digital assets once the authorization process is complete. The two concepts work together but are not interchangeable.
What are some everyday examples of authorization in action?
Common examples include Windows requiring an authorized user account and password to log in, iTunes requiring a computer to be authorized before making store purchases, and corporate systems requiring employees to log in before accessing company files.
Why is understanding authorization important for organizational security?
Knowing how authorization works helps organizations protect sensitive digital resources from unauthorized access. By correctly defining and enforcing access policies, companies can reduce the risk of data breaches and limit the damage that hackers or malicious actors can cause.
References
Network and Computer Systems Administrators. (September 2020). Bureau of Labor Statistics.
Why Nearly 50 Percent of Organizations Are Failing at Password Security. (October 2018). TechRepublic.
The Windows 10 Security Guide: How to Protect Your Business. (July 2020). ZD Net.
Authorize or Deauthorize Your Computer for iTunes Store Purchases. (January 2020). Apple.
