Identity_Authentication_Authorization_Accountability

1. Identification:
Your name, username, ID number, employee number, SSN etc.
“I am Thor”.
2. Authentication:
“Prove you are Thor”. - Should always be done with Multifactor Authentication!
Something you know - Type 1 Authentication (passwords, pass phrase, PIN etc.).
Something you have - Type 2 Authentication (ID, Passport, Smart Card, Token, cookie on PC etc.).
Something you are - Type 3 Authentication (and Biometrics) (Fingerprint, Iris Scan, Facial geometry etc.).
Somewhere you are - Type 4 Authentication (IP/MAC Address).
Something you do - Type 5 Authentication (Signature, Pattern unlock).
3. Authorization
What are you allowed to access - We use Access Control models, what and how we implement depends on the organization and what our security goals are.
More on this in Domain 5 - Identity and Access Management (DAC, MAC, RBAC, RUBAC)
4. Accountability (also often referred to as Auditing)
Trace an Action to a Subjects Identity:
Prove who/what a given action was performed by (non-repudiation).