Authentication factors (something you know, have, are) in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does the authentication factor "something you know" refer to?

It refers to information that only the user should know, such as a password, PIN, or answer to a security question.

beginner

Give an example of "something you have" in authentication.

An example is a physical item like a security token, a smartphone with an authentication app, or a smart card that the user possesses.

beginner

What does "something you are" mean in authentication factors?

It means using a unique physical characteristic of the user, such as a fingerprint, facial recognition, or iris scan, to verify identity.

intermediate

Why is multi-factor authentication more secure than single-factor authentication?

Because it requires two or more different types of authentication factors, making it harder for attackers to gain access by compromising just one factor.

intermediate

What is an example of combining "something you know" and "something you have"?

Using a password (something you know) together with a one-time code sent to your phone (something you have) is a common multi-factor authentication method.

Which of the following is an example of "something you are"?

A Security token

B Fingerprint scan

C Password

D PIN

Fingerprint scan is a biometric factor, which is "something you are".

What type of authentication factor is a smartphone app that generates a code?

A Something you do

B Something you know

C Something you are

D Something you have

A smartphone app that generates codes is considered a possession factor because it runs on a device you have, so it is "something you have".

Which factor does a password belong to?

A Something you have

B Something you are

C Something you know

D Something you do

A password is information you know, so it belongs to "something you know".

Why is using only a password considered less secure?

A It uses only one authentication factor

B Passwords are always easy to guess

C Passwords expire too quickly

D Passwords are biometric data

Using only a password means relying on a single factor, which is less secure than multi-factor authentication.

Which combination is an example of multi-factor authentication?

A Password and security token

B Fingerprint and facial recognition

C PIN and password

D Password and PIN

Password (something you know) plus security token (something you have) combine two different factors.

Explain the three main types of authentication factors and give one example for each.

Think about knowledge, possession, and physical traits.

Why is multi-factor authentication recommended over single-factor authentication?

Consider how combining factors protects better.

Practice

1. Which of the following is an example of something you know in authentication factors?

easy

A. A fingerprint

B. A password

C. A security token

D. A smartphone app

Solution

1. Step 1: Understand the category 'something you know'

   This factor refers to information only the user knows, like a password or PIN.

2. Step 2: Match options to categories

   A password is knowledge-based; a security token and smartphone app are 'something you have'; fingerprint is 'something you are'.

3. Final Answer:

   A password -> Option B

4. Quick Check:

   Knowledge factor = Password [OK]

Hint: Passwords are always 'something you know' [OK]

Common Mistakes:

• Confusing biometric (fingerprint) with knowledge
• Thinking a device (token) is knowledge
• Mixing possession with knowledge

2. Which of the following correctly represents something you have as an authentication factor?

easy

A. A hardware security key

B. A secret question answer

C. Your voice

D. Your birthdate

Solution

1. Step 1: Define 'something you have'

   This factor means a physical object you possess, like a hardware key or phone.

2. Step 2: Identify the correct option

   A hardware security key is a physical device you have; birthdate and secret answers are knowledge; voice is biometric.

3. Final Answer:

   A hardware security key -> Option A

4. Quick Check:

   Possession factor = Hardware key [OK]

Hint: Physical devices are 'something you have' [OK]

Common Mistakes:

• Choosing personal info as possession
• Confusing biometrics with possession
• Selecting knowledge-based answers

3. Consider this code snippet representing a simple authentication check:

user_input = '1234'
stored_pin = '1234'
if user_input == stored_pin:
    print('Access granted')
else:
    print('Access denied')

Which authentication factor does this code represent?

medium

A. Something you know

B. Something you have

C. Something you are

D. Something you do

Solution

1. Step 1: Analyze the code's authentication method

   The code compares a user input PIN to a stored PIN, verifying knowledge of a secret.

2. Step 2: Match the factor type

   Since it checks a secret code, it is 'something you know'.

3. Final Answer:

   Something you know -> Option A

4. Quick Check:

   PIN check = Knowledge factor [OK]

Hint: PIN or password checks are 'something you know' [OK]

Common Mistakes:

• Thinking code checks possession
• Confusing biometrics with PIN
• Selecting 'something you do' which is not standard

4. A system uses fingerprint scanning for login but sometimes denies access even for authorized users. What is the most likely cause?

medium

A. The fingerprint scanner is a 'something you know' factor

B. The system uses multi-factor authentication

C. Users forgot their passwords

D. The fingerprint sensor hardware is malfunctioning

Solution

1. Step 1: Understand fingerprint scanning as a biometric factor

   Fingerprint is 'something you are', relying on hardware to read biometrics accurately.

2. Step 2: Identify cause of denial

   If authorized users are denied, hardware malfunction or sensor errors are likely causes, not user knowledge or multi-factor setup.

3. Final Answer:

   The fingerprint sensor hardware is malfunctioning -> Option D

4. Quick Check:

   Biometric errors usually mean hardware issues [OK]

Hint: Biometric denial often means hardware problem [OK]

Common Mistakes:

• Confusing biometrics with knowledge factors
• Blaming password issues for fingerprint errors
• Assuming multi-factor causes denial

5. A company wants to improve security by requiring two authentication factors: a password and a fingerprint scan. Which statement best describes this setup?

hard

A. It uses only 'something you have' factors

B. It uses two 'something you know' factors

C. It uses multi-factor authentication combining knowledge and biometrics

D. It uses single-factor authentication

Solution

1. Step 1: Identify each factor type

   Password is 'something you know'; fingerprint is 'something you are' (biometric).

2. Step 2: Understand multi-factor authentication

   Using two different factor types together is multi-factor authentication, improving security.

3. Final Answer:

   It uses multi-factor authentication combining knowledge and biometrics -> Option C

4. Quick Check:

   Two different factor types = Multi-factor [OK]

Hint: Different factor types mean multi-factor authentication [OK]

Common Mistakes:

• Thinking password and fingerprint are same factor
• Confusing multi-factor with single-factor
• Assuming both are possession factors