FREE Security LESSON · Security
Make identity a chain of proof
Authentication, sessions, authorization, and recovery
Identity security is a sequence of claims with different strengths.
An authenticator proves control of a factor under a protocol; a session binds later requests to that event; authorization decides whether this actor may perform this action on this resource now. Enrollment, recovery, delegation, revocation, and audit are part of the same chain and often weaker than the primary login.
Authentication names an actor; authorization protects an object; recovery must not silently bypass both.
Account recovery defines the real assurance level.
If a help desk, email reset, backup code, or device migration can replace a strong authenticator, attackers target that path. Bind recovery to risk, notify through independent channels, limit session lifetime and privilege after recovery, and preserve an auditable way to challenge unauthorized change.
The easiest accepted proof of identity is the system’s effective authentication strength.