BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.4 Authorization

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 5 against SP 800-57 Part 1 Rev. 4
All changes in this version
removed 3 Security Services part of 3

Title changed

Before · SP 800-57 Part 1 Rev. 4

Authorization

After · SP 800-57 Part 1 Rev. 5

Authorization

Control changed

Before · SP 800-57 Part 1 Rev. 4

Authorization is concerned with providing an official sanction or permission to perform a security function or activity (e.g., accessing a room). Authorization is considered as a security service that is often supported by a cryptographic service. Normally, authorization is granted only after the execution of a successful source authentication 2 service. A non-cryptographic analog of the interaction between source authentication and authorization is the examination of an individual’s credentials to establish their identity (the source authentication process); after verifying the individual's identity and verifying that the individual is authorized access to some resource, such as a locked room, the individual is then provided with the key (e.g., an authorization key) or password that will allow access to that resource. Source authentication can also be used to authorize a role (such as a system administrator or audit role), rather than to identify an individual. Once authenticated for a role, an entity is authorized for all the privileges associated with that role.

After · SP 800-57 Part 1 Rev. 5

Authorization is concerned with providing an official sanction or permission to perform a security function or activity (e.g., accessing a room). Authorization is considered as a security service that is often supported by a cryptographic service. Normally, authorization is granted only after the execution of a successful source authentication 2 service. A non-cryptographic analog of the interaction between source authentication and authorization is the examination of an individual’s credentials to establish their identity (the source authentication process); after verifying the individual's identity and verifying that the individual is authorized access to some resource, such as a locked room, the individual is then provided with the key (e.g., an authorization key) or password that will allow access to that resource. Source authentication can also be used to authorize a role (such as a system administrator or audit role), rather than to identify an individual. Once authenticated for a role, an entity is authorized for all the privileges associated with that role.