Authentication is the process of verifying the identity of a user, person, or device. In the context of information security, it confirms that a user is who they claim to be before granting them access to a system, application, or network. It is a critical component of access control.
Common Methods & Examples
- Something you know: Knowledge-based factors.
- Example: A username and password, or a PIN.
- Something you have: Possession-based factors.
- Example: A keycard, a physical token, or a one-time code sent to your phone.
- Something you are: Inherence-based factors.
- Example: Biometrics, such as a fingerprint, facial scan, or voice recognition.
ISO 27001 Context
ISO 27001 requires robust authentication mechanisms to protect information assets (ISO 27001 Annex A 8.5 Secure Authentication). It includes a requirements on authentication information (ISO 27001 Annex A 5.17 Authentication Information).
