Authorization is the real perimeter, not identity
Multiple security analysts argue that authorization—not authentication—is the critical control in modern, API-driven systems. Per Opal.dev, breaches unfold at the junction between trust and action, not at login. The Verizon 2024 DBIR found most breach impact stems from lateral movement and privilege escalation, not initial access.
Bottom line — Authorization failures, not authentication gaps, drive most SaaS breaches, per Opal.dev and Verizon's 2024 DBIR.
Go deeper (6)
- Opal.dev argues that 'identity is the new perimeter' misses the point: what matters is what an identity is allowed to do once inside. Authorization has always been the real perimeter, but it's more complex and user-specific than authentication.
- Mike Barker on LinkedIn notes that in API-first, cloud-distributed systems, there is no single boundary—only identity and permission enforcement at runtime. Broken authorization is a logic failure, not a syntax failure, and can pass static scanning.
- PigeonSec's framework (GTFO) emphasizes ownership checks on a per-route basis: before any CRUD operation, verify the requestor's identity and that the resource's ownership attribute matches that identity. Otherwise return 401.
- Microsoft's Zero Trust guidance recommends applying least privilege, using incremental consent, and separating delegated permissions (for interactive users) from application permissions (for background services).
- Hoop.dev describes Software-Defined Perimeters (SDPs) that hide applications from unauthorized users, with authorization policies determining who gets access to what. Regular policy updates are needed as threats evolve.
- Opal.dev cites real-world breaches: 23andMe (credential stuffing exploited a family-sharing feature), MOVEit (SQL injection with unsegmented backend access), and Snowflake (stolen credentials with persistent high-privilege roles). All were authorization failures.