How authentication works
A person presents a claim of identity, such as a username, and then proves it with one or more factors. Factors fall into three groups: knowledge (a password or PIN), possession (a phone, hardware key, or smartcard), and inherence (a fingerprint or face scan).
Systems that require more than one group use multi-factor authentication. Behind the scenes, protocols such as SAML, OpenID Connect, and Kerberos pass proof of identity between systems. After a successful check, the user receives a session or token that is trusted for a limited time.
Why it matters for Canadian organizations
Stolen and reused credentials are among the most common ways attackers get into networks, which makes authentication a priority for any organization holding personal information. PIPEDA expects safeguards proportional to data sensitivity, and weak login controls are difficult to defend after a breach.
The Canadian Centre for Cyber Security recommends multi-factor authentication as a baseline control, and cyber insurers frequently require it on email, remote access, and administrator accounts. Federally regulated institutions are also expected to align with OSFI B-13 expectations on managing access to their systems.
How to implement it
Enforce multi-factor authentication on email, VPN, cloud consoles, and all privileged accounts first. Prefer phishing-resistant methods such as FIDO2 security keys or passkeys over SMS codes where possible, and block legacy protocols that cannot support modern checks.
Use single sign-on to reduce password sprawl and give one place to enforce policy. Monitor for impossible travel, repeated failures, and unusual device enrolments. Password managers and long passphrases improve the remaining password-based flows without burdening staff. Educate staff on prompt-bombing so they do not approve unexpected requests.
Frequently asked questions
Is authentication the same as authorization?
No. Authentication proves who you are, while authorization decides what you are allowed to do once your identity is confirmed. A user can be fully authenticated and still be denied access to a particular file or system by policy.
What are the three authentication factors?
The three factors are something you know (a password or PIN), something you have (a phone, token, or smartcard), and something you are (a fingerprint or face). Combining factors from different groups makes it much harder for an attacker to impersonate you.
Are SMS codes secure enough for authentication?
They are better than a password alone but weaker than authenticator apps or hardware keys, because SMS can be intercepted through SIM swapping or phishing. For privileged accounts and sensitive data, phishing-resistant methods are the stronger choice.
Related service: Identity and access management