[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 4 · 4.2.c
AP Cybersecurity · Securing Devices
Determining the Type of Authentication
Name the factor by the kind of proof it asks for — then count how many kinds are required.
key ideaName the factor by the kind of proof it asks for — and count how many kinds are required.
The categories
Authentication mechanisms are technical controls that verify a user's identity so that only authorized users reach a system. The proof supplied is called a factor, and the four types differ in what an adversary would have to obtain.
Reading down, the proof gets harder to hand over by mistake — and harder to replace once compromised. A password can be changed; a fingerprint cannot.| Factor | Examples | Strength depends on | Weakness |
|---|
| knowledge | passwords, PINs, answers to preselected challenge questions | being something an adversary cannot easily guess | guessable, and easy to disclose to a convincing caller |
| possession | access card, bank card, cell phone, authentication token | how difficult it is to duplicate | can be lost, stolen or cloned |
| biometric | fingerprints, palm prints, facial recognition, iris or retina scans, voice | the difficulty of forging that feature | cannot be changed if compromised |
| location | Wi-Fi signals, GPS data, time zone settings, IP address | how precisely location can be established | spoofable; rarely sufficient alone |
The knowledge row carries the CED's own caution: a knowledge factor works only if an adversary cannot easily guess it — and challenge-question answers are exactly the facts people share publicly.
FactorThe proof a user provides to identify themselves. Its type is decided by what kind of thing the proof is.
Knowledge factorSomething the user knows. Effective only if it is not easily guessable.
Possession factorAn object unique to the user. The harder it is for an adversary to duplicate, the stronger it is.
Biometric factorA measurement of a feature of the human body — difficult to forge, and impossible to reissue.
Location factorAn inference about where the user is, used to allow or deny access by rule.
Multifactor authenticationUsing more than one factor — more secure because the user must supply more than one kind of proof.
Telling them apart
Knowa fact — changeable
Havean object — losable
Area body feature — permanent
the deciding question
- Ask what the proof is: a fact, an object, a body measurement, or a place.
- MFA means more than one type — two passwords are still single-factor.
- A biometric identifies well and cannot be reissued; treat it as a username more than a password.
- Location rules allow or deny access based on where the user appears to be — useful as a supporting factor.
Worked examples
EX 1
Count the factors
A system asks for a password, then a code from an authenticator app. A second system asks for a password and the name of your first school. Which is MFA?
1
Classify the first system's proofs
Password — knowledge. App code — possession, since the phone is the object.
2
Count the types
Two different types, so this is multifactor authentication.
3
Classify the second system's proofs
Password — knowledge. Challenge-question answer — also knowledge.
4
Count again
One type twice, so this is single-factor despite asking two questions.
5
State the rule
MFA requires more than one type of proof, not more than one prompt.
EX 2
Why biometrics are unlike passwords
A fingerprint database is breached. Compare the consequences with a password database breach.
1
State the password case
Every user changes their password; the stolen file becomes worthless.
2
State the biometric case
Users cannot change their fingerprints.
3
Name the permanence problem
The compromise is for life, and applies to every system using that biometric.
4
Give the design consequence
Pair biometrics with another factor, and store templates rather than images where possible.
5
State the framing
A biometric identifies; it should rarely authorize alone.
EX 3
A location factor in practice
A bank blocks a login that arrives from an unexpected country minutes after a domestic one. Which factor, and what are its limits?
1
Name the factor
Location — inferred from IP address, and possibly GPS or time zone.
2
State the rule applied
Rules can be established for allowing or denying access based on location.
3
Note why it worked here
Two locations minutes apart is physically impossible, which is a strong signal.
4
State the limits
Location can be spoofed, and legitimate travel produces false positives.
5
Give the correct role
A supporting factor that adjusts risk, rather than a sole gate.
Watch out
Two prompts is not two factors
A password plus a challenge question is knowledge twice. MFA requires proofs of different types.
Knowledge factors are only as good as their unguessability
The CED states the condition directly: a knowledge factor must be something an adversary cannot easily guess — which rules out most challenge questions.
Possession strength is about duplication
The more difficult it is for an adversary to duplicate the object, the stronger the factor. A cloned card is a possession factor that has failed.
Biometrics cannot be reissued
They are difficult to forge and impossible to change. That asymmetry is why they belong alongside another factor rather than alone.