Technology brief: Authenticating securely – five levels for greater clarity
Password, passkey or smartcard – there are many ways to protect access to systems and applications. But how secure are the individual procedures? A classification provides guidance and helps determine which security levels different authentication procedures, methods and services can actually achieve.
Authentication ensures that only authorised persons and processes can access protected systems and applications. Numerous procedures are available today – from traditional passwords to passkeys and smartcards.
However, these procedures do not all offer the same level of protection. Depending on the technology used and how it is implemented, their security properties can differ considerably in some cases.
Five security categories
To make these differences easier to classify, authentication procedures, methods and services are divided into three security categories – "low", "medium" and "high" – with the "medium" and "high" categories each subdivided into another two.
The requirements for each of the five security categories are described, providing a basis for assessing different solutions.
Aligned with an international standard
Although the classification is based on the Authentication Assurance Levels (AAL 1–3) of the US National Institute of Standards and Technology (NIST), it has been slightly adapted in the technology brief "Security categories for authentication procedures, methods and services" and extended to cover resistance to real-time phishing attacks.
In its present form, the classification does not provide a basis for formal testing or certification. It can, however, serve organisations and companies as a practical basis – for example, for drafting security requirements, recommendations or best practices. In particular, it thus provides a simple, easy-to-understand guide for selecting and assessing authentication solutions.