This article is part of our series on the OWASP Top 10 — the ten most common and most dangerous types of cyber attack. As always, we keep things simple and bite-sized, so you don’t have to wade through pages of text or keep a dictionary close at hand. Last time we explained what an SQL injection is, and going by the numbers, plenty of you found it a useful read. This week we move on to the next item on the list: broken authentication.

What is broken authentication?

The term “broken authentication” is a bit vague at first glance, but it’s accurate enough. You may not have come across this exact phrase before — it isn’t one that turns up often in the headlines. And yet you’ve almost certainly seen it in action, just under a different name. Think of the stories that read something like: “Company apologises for data leak in which millions of accounts were hacked.” That’s broken authentication at work.

To understand what’s actually breaking, it helps to look at how logging in works. Whenever you sign in to an application, three things happen in sequence:

  1. Identification — “Who are you?” This is your username: the identity you claim.
  2. Authentication — “Are you really who you say you are?” This is your password (and ideally a second factor): the proof that backs up your claim.
  3. Authorisation — “What are you allowed to do?” These are your permissions: what the system lets you access once you’re in.

Broken authentication is a failure in step two. An attacker pretends to be a legitimate user using credentials they’ve obtained — perhaps leaked in an earlier data breach, or guessed through a brute-force attack, where a tool simply tries password after password until one works. If the application can’t tell the difference between the real user and the impostor, the attacker is in.

A note on naming: in the OWASP Top 10 of 2017 this was listed as A2: Broken Authentication. In the current OWASP Top 10 (2021), it has been renamed and broadened to A07: Identification and Authentication Failures. The newer name reflects that the problem isn’t only about passwords — weaknesses in how identities are confirmed and sessions are managed all fall under the same heading.

What are the consequences?

In principle, every application that has a login is exposed to this risk. And it only takes one compromised account for an attacker to get a foot in the door. Just how much damage they can do depends entirely on the application and on the permissions tied to the account they’ve taken over. At the very least, there’s a real risk of identity theft.

This is where a second, quieter problem comes in. Organisations often pay too little attention to access management, which means accounts end up carrying far more permissions than they actually need. So when authentication breaks and an attacker walks in, they frequently inherit a level of access well beyond what that account should ever have had — and the potential damage grows accordingly.

How do you defend against broken authentication?

The good news is that the defences are well understood, and most of them are straightforward to put in place:

  • Identity and Access Management (IAM): Set a clear policy defining who is allowed to access what, and give each account only the permissions it genuinely needs — no more.
  • Approval for sensitive actions: Require sign-off before important changes go through, so a single hijacked account can’t act unchecked.
  • Two-factor / multi-factor authentication (2FA/MFA): Ask for more than just a password — for example, a one-time code from an app or sent by SMS. Even if a password leaks, the attacker still can’t get in without the second factor. This is one of the single most effective steps you can take.
  • Weak-password checks: Block common and previously-breached passwords at the point a user sets them, so accounts aren’t protected by something a tool can guess in seconds.
  • Limiting login attempts: Don’t allow unlimited tries. Locking or slowing down repeated failed attempts shuts down brute-force attacks before they get anywhere.

Curious how the passwords across your own organisation would hold up? A Rootsec penetration test puts your logins to the test the same way a real attacker would — finding the weak spots before someone else does. At Rootsec, our goal has always been to make information security simple, and this series is part of that mission.

Want to know whether your applications are vulnerable to broken authentication? Book a free consultation.