What it means
Authentication answers "who are you". Authorization, which usually comes next, answers "what are you allowed to do". Common methods include passwords with two-factor codes, email sign-in links, sign-in with Google or Microsoft, and single sign-on for companies.
Role-based access control then gives each user the permissions that fit their role.
Why it matters for a business
Weak authentication is one of the most common causes of breaches. Getting it right protects customer data and makes business customers more willing to buy, since many require single sign-on and two-factor sign-in.
A business example
Things to watch
-
Offer two-factor sign-in, at least for staff and admins.
-
Store passwords only as secure hashes, or avoid them.
-
Check permissions on the server for every request.
-
Log sign-ins and unusual activity.