ossf/secure-sw-dev-fundamentals

Does this refer to user permissions?

Opened this issue · 1 comments

* **Authorization**<br>Determine what that user is allowed (authorized) to do before deciding to do it. You can think of authorization as a list of what each user is allowed to do. If it is easy for an attacker to add authorizations, then secure I&A means little. This is critical for implementing confidentiality and/or integrity. Watch out: the words *authentication* and *authorization* sound similar, but they are not the same thing. You may know exactly who someone is (authentication), but still not allow that person to do something (authorization).

Among other things, yes. Authorization determines what the user is allowed to do. It can be permission settings, but it can be other things too.