Why Authentication factors (something you know, have, are) in Cybersecurity? - Purpose & Use Cases

The Big Idea

What if a simple password isn't enough to keep your secrets safe?

The Scenario

Imagine trying to protect your house by only locking the front door with a simple key that anyone could copy or guess. You worry someone might sneak in because the lock is easy to pick or the key could be lost or stolen.

The Problem

Relying on just one way to prove who you are, like a password, is risky. Passwords can be forgotten, guessed, or stolen. This makes your accounts and personal information vulnerable to hackers and identity thieves.

The Solution

Using multiple ways to prove your identity--like something you know (a password), something you have (a phone or security token), and something you are (your fingerprint)--makes it much harder for someone else to pretend to be you. This layered approach strengthens security and keeps your information safer.

Before vs After

✗ Before

if password == stored_password:
    allow_access()

✓ After

if password == stored_password and token == user_token and fingerprint == stored_fingerprint:
    allow_access()

What It Enables

This approach enables strong protection of your digital life by making unauthorized access extremely difficult.

Real Life Example

When you log into your bank app, you enter your password (something you know), then receive a code on your phone (something you have), and sometimes use your fingerprint (something you are) to confirm it's really you.

Key Takeaways

Single methods like passwords can be weak and risky.

Combining multiple authentication factors greatly improves security.

Authentication factors include knowledge, possession, and biometrics.

Practice

1. Which of the following is an example of something you know in authentication factors?

easy

A. A fingerprint

B. A password

C. A security token

D. A smartphone app

Solution

1. Step 1: Understand the category 'something you know'

   This factor refers to information only the user knows, like a password or PIN.

2. Step 2: Match options to categories

   A password is knowledge-based; a security token and smartphone app are 'something you have'; fingerprint is 'something you are'.

3. Final Answer:

   A password -> Option B

4. Quick Check:

   Knowledge factor = Password [OK]

Hint: Passwords are always 'something you know' [OK]

Common Mistakes:

• Confusing biometric (fingerprint) with knowledge
• Thinking a device (token) is knowledge
• Mixing possession with knowledge

2. Which of the following correctly represents something you have as an authentication factor?

easy

A. A hardware security key

B. A secret question answer

C. Your voice

D. Your birthdate

Solution

1. Step 1: Define 'something you have'

   This factor means a physical object you possess, like a hardware key or phone.

2. Step 2: Identify the correct option

   A hardware security key is a physical device you have; birthdate and secret answers are knowledge; voice is biometric.

3. Final Answer:

   A hardware security key -> Option A

4. Quick Check:

   Possession factor = Hardware key [OK]

Hint: Physical devices are 'something you have' [OK]

Common Mistakes:

• Choosing personal info as possession
• Confusing biometrics with possession
• Selecting knowledge-based answers

3. Consider this code snippet representing a simple authentication check:

user_input = '1234'
stored_pin = '1234'
if user_input == stored_pin:
    print('Access granted')
else:
    print('Access denied')

Which authentication factor does this code represent?

medium

A. Something you know

B. Something you have

C. Something you are

D. Something you do

Solution

1. Step 1: Analyze the code's authentication method

   The code compares a user input PIN to a stored PIN, verifying knowledge of a secret.

2. Step 2: Match the factor type

   Since it checks a secret code, it is 'something you know'.

3. Final Answer:

   Something you know -> Option A

4. Quick Check:

   PIN check = Knowledge factor [OK]

Hint: PIN or password checks are 'something you know' [OK]

Common Mistakes:

• Thinking code checks possession
• Confusing biometrics with PIN
• Selecting 'something you do' which is not standard

4. A system uses fingerprint scanning for login but sometimes denies access even for authorized users. What is the most likely cause?

medium

A. The fingerprint scanner is a 'something you know' factor

B. The system uses multi-factor authentication

C. Users forgot their passwords

D. The fingerprint sensor hardware is malfunctioning

Solution

1. Step 1: Understand fingerprint scanning as a biometric factor

   Fingerprint is 'something you are', relying on hardware to read biometrics accurately.

2. Step 2: Identify cause of denial

   If authorized users are denied, hardware malfunction or sensor errors are likely causes, not user knowledge or multi-factor setup.

3. Final Answer:

   The fingerprint sensor hardware is malfunctioning -> Option D

4. Quick Check:

   Biometric errors usually mean hardware issues [OK]

Hint: Biometric denial often means hardware problem [OK]

Common Mistakes:

• Confusing biometrics with knowledge factors
• Blaming password issues for fingerprint errors
• Assuming multi-factor causes denial

5. A company wants to improve security by requiring two authentication factors: a password and a fingerprint scan. Which statement best describes this setup?

hard

A. It uses only 'something you have' factors

B. It uses two 'something you know' factors

C. It uses multi-factor authentication combining knowledge and biometrics

D. It uses single-factor authentication

Solution

1. Step 1: Identify each factor type

   Password is 'something you know'; fingerprint is 'something you are' (biometric).

2. Step 2: Understand multi-factor authentication

   Using two different factor types together is multi-factor authentication, improving security.

3. Final Answer:

   It uses multi-factor authentication combining knowledge and biometrics -> Option C

4. Quick Check:

   Two different factor types = Multi-factor [OK]

Hint: Different factor types mean multi-factor authentication [OK]

Common Mistakes:

• Thinking password and fingerprint are same factor
• Confusing multi-factor with single-factor
• Assuming both are possession factors