Authentication Methods

What must a user do to access an account in an access control system?

Authenticate by supplying the correct credentials, proving that they are the valid account holder

What are accounts configured with in an access control system?

Permissions to access resources and, for privileged accounts, rights to change the system configuration

What is zero trust?

A security framework in which no user or device should ever be automatically trusted, regardless of location or previous authentication

What does zero trust require before access is granted?

All users and devices are authenticated, authorized, and continuously validated

What kind of authentication should be used for all users and devices trying to access network resources?

Strict authentication

What does the validity of the whole access control system depend on?

The credentials for an account being known and used only by the account holder

What is the format of a credential called?

An authentication factor

What are the principal authentication factor categories?

Knowledge, possession, and inherence

What is a knowledge factor?

Something you know, such as a password

What is a possession factor?

Something you have, such as a smart card or smartphone

What is an inherence factor?

Something you are, such as a fingerprint

Why is using a single authentication factor less reliable?

A password could be shared, a device token could be stolen, or a facial recognition system could be spoofed using a photograph

When is an authentication technology considered strong?

When it is multifactor

What is multifactor authentication (MFA)?

The user must submit at least two different types of credentials

Does submitting two of the same type of credentials count as MFA?

No

What is a valid MFA example from the text?

Username/password and a fingerprint

Why is username/password plus a PIN not valid MFA in the text?

They are both knowledge-based

How does MFA support zero trust?

It is a core component of the "never trust, always verify" principle

Why does MFA make unauthorized access more difficult?

It provides a second layer of authentication

What is 2-step verification?

A means of using a soft token to check that a sign-in request is authentic

What does the user register first for 2-step verification?

A trusted contact method

What can a trusted contact method be?

An email account or phone number

What does the user use to log on before receiving a soft token in 2-step verification?

A password or biometric recognition

When might an app generate and send a token in 2-step verification?

If it detects a new device, a different location, or is configured by policy to require 2-step verification in all instances

How can the 2-step verification code be delivered?

By email, SMS text, or an automated voice call

What must the user do with the soft token code in 2-step verification?

Input it within a given time frame to be granted access

What may soft tokens also be referred to as?

A one-time password (OTP)

How long is an OTP valid?

Only for a single login session

What is generated for each login attempt with OTP?

A new unique passcode

Why do OTPs add security if a user's password is compromised?

The attacker will not have access to the OTP

What is TOTP?

An OTP valid for a set amount of time before it expires

What happens if a TOTP is not entered within the specified timeframe?

A new OTP will need to be requested

What is HOTP?

An OTP generated using a counter-based approach

How does HOTP ensure every password is unique and can only be used once?

The counter is increased each time the OTP is requested

What is challenge-response OTP?

The server sends a challenge, and the OTP generator uses it to generate a unique OTP

Why do OTPs work as a form of multifactor authentication?

They typically require the user to have access to a specific device tied to their account

What can an authenticator app be used for?

Passwordless access or as a two-factor authentication mechanism

Where is an authenticator app installed?

On a trusted device under the sole control of the user

How must the trusted device be protected?

By its own authentication system, such as a screen lock opened via a fingerprint

How is a service or network typically registered with an authenticator app?

By scanning a QR code and then completing some validation checks

What establishes a trust relationship during authenticator app registration?

Encryption keys

What happens when the user tries to sign in with an authenticator app?

The service or network generates a prompt on the authenticator

What must the user do to authorize the sign-in request from an authenticator app?

Unlock the device

How does the authenticator complete authentication after authorization?

It either displays a soft token for the user to input or directly communicates to the service or network

What happens after the authenticator verifies the user?

The service grants the user access

What is a hard token?

A token implemented as firmware in a smart card or USB thumb drive rather than running on a smartphone

How is a hard token used before authentication?

It is first registered with the service or network

How does a user authorize a hard token?

By a password, PIN, fingerprint reader, or voice recognition

What does the hard token do after authorization?

Transmits its credentials to the service

What happens after the hard token transmits its credentials?

The service grants the user access

What standards are these hard token devices typically compliant with?

Fast Identity Online (FIDO) version 2 standards