Authentication factors (something you know, have, are) in Cybersecurity - Step-by-Step Execution

Concept Flow - Authentication factors (something you know, have, are)

User tries to access system

↓

System asks for authentication

↓

User provides factor

↓

System checks if factor is correct

↓

Access granted or denied

The user tries to access a system, provides one or more authentication factors (knowledge, possession, or inherence), and the system verifies them to allow or deny access.

Execution Sample

Cybersecurity

User inputs password (something you know)
User inserts security token (something you have)
User scans fingerprint (something you are)

This shows the three types of authentication factors a user can provide to prove identity.

Analysis Table

Step	Authentication Factor Type	User Input	System Check	Result
1	Something you know	Password: 'mypassword123'	Password matches stored password	Pass
2	Something you have	Security token code: '456789'	Code matches token generator	Pass
3	Something you are	Fingerprint scan	Fingerprint matches stored biometric data	Pass
4	Final decision	All factors verified	All checks passed	Access granted

💡 All authentication factors verified successfully, so access is granted.

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
Password check	Not checked	Pass	Pass	Pass	Pass
Token check	Not checked	Not checked	Pass	Pass	Pass
Biometric check	Not checked	Not checked	Not checked	Pass	Pass
Access status	Denied	Denied	Denied	Denied	Granted

Key Insights - 2 Insights

Why does the system ask for different types of factors instead of just one?

Using multiple factors (knowledge, possession, inherence) increases security by making it harder for unauthorized users to gain access, as shown in the execution_table where all three checks must pass.

What happens if one factor fails the system check?

If any factor fails, the system denies access immediately. The execution_table shows all factors must pass for access to be granted.

Visual Quiz - 3 Questions

Look at the execution_table at Step 2. What does the system check for?

A Fingerprint match

B Password correctness

C Security token code validity

D User identity confirmation

💡 Hint

Refer to the 'System Check' column in Step 2 of the execution_table.

At which step does the system verify biometric data?

A Step 1

B Step 3

C Step 2

D Final decision

💡 Hint

Check the 'Authentication Factor Type' column for 'Something you are' in the execution_table.

If the password was incorrect at Step 1, what would happen to the 'Access status' variable?

A It would remain Denied

B It would change to Granted

C It would be Unknown

D It would skip to Step 3

💡 Hint

Look at the 'Access status' row in variable_tracker and consider the effect of a failed check.

Concept Snapshot

Authentication factors verify identity using:
- Something you know (password, PIN)
- Something you have (security token, phone)
- Something you are (fingerprint, face)
Using multiple factors improves security by requiring more proof before access.

Full Transcript

Authentication factors are ways a system checks who you are. There are three main types: something you know, like a password; something you have, like a security token; and something you are, like your fingerprint. When you try to access a system, it asks for one or more of these. The system checks each factor. If all checks pass, you get access. If any check fails, access is denied. This method makes it harder for someone else to pretend to be you.

Practice

1. Which of the following is an example of something you know in authentication factors?

easy

A. A fingerprint

B. A password

C. A security token

D. A smartphone app

Solution

1. Step 1: Understand the category 'something you know'

   This factor refers to information only the user knows, like a password or PIN.

2. Step 2: Match options to categories

   A password is knowledge-based; a security token and smartphone app are 'something you have'; fingerprint is 'something you are'.

3. Final Answer:

   A password -> Option B

4. Quick Check:

   Knowledge factor = Password [OK]

Hint: Passwords are always 'something you know' [OK]

Common Mistakes:

• Confusing biometric (fingerprint) with knowledge
• Thinking a device (token) is knowledge
• Mixing possession with knowledge

2. Which of the following correctly represents something you have as an authentication factor?

easy

A. A hardware security key

B. A secret question answer

C. Your voice

D. Your birthdate

Solution

1. Step 1: Define 'something you have'

   This factor means a physical object you possess, like a hardware key or phone.

2. Step 2: Identify the correct option

   A hardware security key is a physical device you have; birthdate and secret answers are knowledge; voice is biometric.

3. Final Answer:

   A hardware security key -> Option A

4. Quick Check:

   Possession factor = Hardware key [OK]

Hint: Physical devices are 'something you have' [OK]

Common Mistakes:

• Choosing personal info as possession
• Confusing biometrics with possession
• Selecting knowledge-based answers

3. Consider this code snippet representing a simple authentication check:

user_input = '1234'
stored_pin = '1234'
if user_input == stored_pin:
    print('Access granted')
else:
    print('Access denied')

Which authentication factor does this code represent?

medium

A. Something you know

B. Something you have

C. Something you are

D. Something you do

Solution

1. Step 1: Analyze the code's authentication method

   The code compares a user input PIN to a stored PIN, verifying knowledge of a secret.

2. Step 2: Match the factor type

   Since it checks a secret code, it is 'something you know'.

3. Final Answer:

   Something you know -> Option A

4. Quick Check:

   PIN check = Knowledge factor [OK]

Hint: PIN or password checks are 'something you know' [OK]

Common Mistakes:

• Thinking code checks possession
• Confusing biometrics with PIN
• Selecting 'something you do' which is not standard

4. A system uses fingerprint scanning for login but sometimes denies access even for authorized users. What is the most likely cause?

medium

A. The fingerprint scanner is a 'something you know' factor

B. The system uses multi-factor authentication

C. Users forgot their passwords

D. The fingerprint sensor hardware is malfunctioning

Solution

1. Step 1: Understand fingerprint scanning as a biometric factor

   Fingerprint is 'something you are', relying on hardware to read biometrics accurately.

2. Step 2: Identify cause of denial

   If authorized users are denied, hardware malfunction or sensor errors are likely causes, not user knowledge or multi-factor setup.

3. Final Answer:

   The fingerprint sensor hardware is malfunctioning -> Option D

4. Quick Check:

   Biometric errors usually mean hardware issues [OK]

Hint: Biometric denial often means hardware problem [OK]

Common Mistakes:

• Confusing biometrics with knowledge factors
• Blaming password issues for fingerprint errors
• Assuming multi-factor causes denial

5. A company wants to improve security by requiring two authentication factors: a password and a fingerprint scan. Which statement best describes this setup?

hard

A. It uses only 'something you have' factors

B. It uses two 'something you know' factors

C. It uses multi-factor authentication combining knowledge and biometrics

D. It uses single-factor authentication

Solution

1. Step 1: Identify each factor type

   Password is 'something you know'; fingerprint is 'something you are' (biometric).

2. Step 2: Understand multi-factor authentication

   Using two different factor types together is multi-factor authentication, improving security.

3. Final Answer:

   It uses multi-factor authentication combining knowledge and biometrics -> Option C

4. Quick Check:

   Two different factor types = Multi-factor [OK]

Hint: Different factor types mean multi-factor authentication [OK]

Common Mistakes:

• Thinking password and fingerprint are same factor
• Confusing multi-factor with single-factor
• Assuming both are possession factors