Authentication

What is Authentication?

Authentication is the process of verifying the identity of a user, person, or device. In the context of information security, it confirms that a user is who they claim to be before granting them access to a system, application, or network. It is a critical component of access control.

Common Methods & Examples

• Something you know: Knowledge-based factors.
  • Example: A username and password, or a PIN.
• Something you have: Possession-based factors.
  • Example: A keycard, a physical token, or a one-time code sent to your phone.
• Something you are: Inherence-based factors.
  • Example: Biometrics, such as a fingerprint, facial scan, or voice recognition.

ISO 27001 Context

ISO 27001 requires robust authentication mechanisms to protect information assets (ISO 27001 Annex A 8.5 Secure Authentication). It includes a requirements on authentication information (ISO 27001 Annex A 5.17 Authentication Information).

About the author

🎓 MSc Security 🛡️ Lead Auditor ⚡ 30+ Years Exp 🏢 Ex-GE Leader

Stuart Barker

ISO 27001 Ninja

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigor with extensive operational experience, including a decade leading Data Governance for General Electric (GE).

As a qualified ISO 27001 Lead Auditor, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. His toolkits represent an auditor-verified methodology designed to minimise operational friction while guaranteeing compliance.