Topic starter
24/06/2026 9:34 pm
TL;DR: Opal Security uses the Deloitte breach to show that password-only authentication and overbroad authorization can turn one compromised account into broad enterprise exposure, especially when access is not continuously constrained. The harder problem is no longer just proving identity, but governing what that identity can do as permissions and context change.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “Authn and Authz: Two Sides of the IAM Coin”.
Key questions
Q: What breaks when authentication is too weak but authorization is broad?
A: One compromised identity can become a full environment compromise when a stolen credential opens broad permissions.
Q: Why do overprivileged accounts make breaches harder to contain?
A: Because the compromise of one account becomes the compromise of whatever that account can already reach.
Q: What are the signs that authorization governance is failing?
A: Common signs include conflicting permissions across applications, frequent code changes for access rules, difficulty answering audit questions, and teams relying on custom logic to grant or block access.
Practitioner guidance
- Tighten authentication on high-value accounts Require phishing-resistant MFA for administrative and sensitive access paths, and remove password-only sign-in wherever a compromise would create broad internal reach.
- Rebuild authorization around actual task scope Compare current entitlements against real job duties, then remove inherited or legacy permissions that no longer map to daily work or approved exceptions.
- Separate emergency access from normal access Keep break-glass access time-bound, monitored, and distinct from routine roles so recovery paths do not become standing privilege by convenience.
Bottom line: The Deloitte breach demonstrates that authentication weakness and overbroad authorization combine into a single failure path, not two separate problems.
What's in the full article
Opal Security's full article covers the control-level discussion this post intentionally leaves at a higher level:
- The article walks through the authn and authz concepts in plain language, including how they differ and how they work together.
- It expands on password, MFA, biometrics, geolocation, and behavioural authentication as distinct proof methods.
- It describes RBAC, ABAC, DAC, MAC, and emergency access as different authorization models and where each fits.
- It retells the Deloitte breach example with more detail on how weak access control enabled broad compromise.
👉 Read Opal Security's analysis of authn and authz under modern IAM pressure →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:43 am
Authentication and authorization are no longer separable controls in modern IAM: the Deloitte case shows that identity proof and privilege scope fail together when one account is overtrusted. A password can open the door, but excessive authorization decides how far the attacker can move once inside. The implication is that IAM programmes must be judged on the combined control plane, not on login success rates alone.
A question worth separating out:
Q: Should organisations treat MFA and least privilege as one programme or two?
A: They should treat them as one programme because authentication and authorization work as a single control chain. MFA reduces the chance of impersonation, while least privilege limits what the impersonator can do if the first control fails. Splitting them into separate workstreams creates gaps that attackers can exploit between login assurance and entitlement scope.
👉 Read our full editorial: Authn and Authz expose the limits of human-scale IAM