From the course: CompTIA Security+ (SY0-701) Cert Prep

Authentication factors

From the course: CompTIA Security+ (SY0-701) Cert Prep

Start my 1-month free trial

Authentication factors

“

- [Instructor] Once you've identified yourself to a system, you must prove that claim of identity. That's where authentication comes into play. Computer systems offer many different authentication techniques that allow users to prove their identity. Let's take a look at four different authentication factors. Something you know, something you are, something you have, and somewhere you are. Now, by far, the most common authentication factor is something you know. Typically, knowledge-based authentication comes in the form of a password that the user remembers and enters into a system during the authentication process. Users should choose strong passwords consisting of as many characters as possible and combining characters from multiple classes, such as uppercase and lowercase letters, digits, and symbols. One of the best ways to create a strong password is to use a passphrase instead. For example, you might choose the easily memorable phrase, "Chocolate-covered strawberries are for me," and write it like this instead. That gives you a strong, complex password that is easy to remember and hard to guess. The second authentication factor is something you are. Biometrics measure one of your physical characteristics, such as a fingerprint, eye pattern, face, or voice. The third authentication factor, something you have, requires the user to have physical possession of a device, such as a smartphone or authentication token key fob like the one shown here. The fourth authentication factor is somewhere you are, such as your physical location in an office building. Being present in a location with restricted access gives the system some confidence in your identity as an insider, but it's important to note that somewhere you are isn't really conclusive on its own. CompTIA does list it in the authentication factors for the Security+ exam, so you should know it, but it's really only useful in combination with some other factor that really proves your identity. The strength of techniques used by each of these authentication factors may be measured by the number of errors that it generates. There are two basic types of error in authentication system. False acceptance errors occur when the system misidentifies an individual as an authorized user and grants access that should be denied. This is a very serious error because it allows unauthorized access to the system, device, information, or facility. The frequency of these errors is measured by the false acceptance rate, FAR. False rejection errors occur when an authorized individual attempts to gain access to a system but is incorrectly denied access by the system. This is not as serious as a false acceptance because it doesn't jeopardize confidentiality or integrity, but it is still a serious error because it jeopardizes the availability of resources to authorized users. The frequency of these errors is measured by the false rejection rate, or FRR. Now, the false acceptance rate on false rejection rates are not by themselves good measures of the strength of an authentication factor because they can be easily manipulated. On one extreme, administrators may configure the system to simply admit nobody at all, giving it a perfect false acceptance rate, but also a very high false rejection rate. Similarly, if the system allows anyone access, it has a perfect false rejection rate, but an unacceptably high false acceptance rate. The solution to this is to use a balanced measure of strength called the crossover error rate. This is the efficacy rate that occurs when administrators tune the system to have equal false acceptance and false rejection rates.

Contents