一位身份安全领域的资深专家近日出版新书《Authorization in Action》，由Manning出版社发行1。该著作深入探讨了认证与授权在信息系统中的本质区别——认证（验证身份）已通过passkeys和FIDO等技术基本得到解决，而授权（确定权限）仍然缺乏标准化规范，主要散落在各应用代码中1。
作者曾任犹他州首席信息官，自2001年起开始研究身份问题，并参与创办互联网身份工作坊（IIW），该论坛已召开42次会议1。2022年末，他加入AWS Identity团队，参与了Amazon Verified Permissions服务和Cedar策略语言的开发工作1。随着AI代理开始代表用户执行行动，精细化授权正成为网络安全和信任体系中"决定一切的问题"1。该书通过虚构的ACME公司案例，详细展示了从代码中嵌入访问控制逐步演进到基于策略的授权管理的过程1。
The gap between authentication and authorization has emerged as a critical challenge in modern cybersecurity, with the former largely resolved through technological advances while the latter remains fragmented and underspecified.1 Authentication, which verifies user identity, has been substantially addressed through technologies like passkeys and FIDO standards.1 Authorization, by contrast—the process of determining what authenticated users are permitted to do—continues to lack standardization and remains predominantly embedded within application code rather than enforced through systematic frameworks.1
An author with decades of experience in identity systems has published a new book titled "Authorization in Action" through Manning to address this gap.1 The author previously served as Utah's Chief Information Officer and began researching identity issues in 2001.1 They co-founded the Internet Identity Workshop, which has now held 42 iterations of its conference.1 Most recently, the author joined Amazon's Identity team in late 2022, where they contributed to the development of Amazon Verified Permissions and the Cedar policy language.1 The book uses a fictional ACME company as a case study to illustrate the evolution from code-embedded access controls to policy-based authorization approaches.1
The urgency of solving authorization has intensified with the rise of artificial intelligence agents that act on behalf of users.1 As these AI systems become more prevalent, authorization frameworks have become a "make-or-break question" for both security and trust in digital systems.1
评论
还没有评论，欢迎留下第一条。