Authentication
Authentication is the process of verifying the identity of a user, device, or system before granting access to resources.
“A procedure determining whether a person or a process is, in fact, who or what it is declared to be.”
(Definition reproduced from the ISTQB Glossary. Copyright belongs to ISTQB.)
View the complete ISTQB GlossaryWhat is Authentication?
Authentication confirms that an entity is who it claims to be using credentials such as passwords, biometrics, security tokens, or digital certificates.
Identity verification: Authentication confirms user identity before access is granted.
Authentication methods: Common methods include passwords, multi-factor authentication, biometrics, and certificates.
Testing focus: Testers verify successful authentication as well as resistance to unauthorized access attempts.
Real World Example
An online banking login flow is being reviewed after fraud analysts report repeated attempts to discover valid customer accounts.
The concern is not whether ordinary login works; it is how the system behaves when someone intentionally misuses it. Authentication points testing toward that hostile or risky behavior.
The tester probes rate limits, error messages, audit events, lockout behavior, and monitoring signals to see whether the system gives attackers useful feedback.
The team strengthens the controls because Authentication helps them test the product from the perspective of misuse, not only normal customer journeys.
Practice Questions
Question 1
Which observation MOST indicates a weakness in authentication?
Question 2
Which test BEST validates authentication robustness?
Test your knowledge with real ISTQB-style questions
You’ve learned Authentication. Test your understanding with topic-specific questions in our Mock Exams.