Multi-factor authentication (MFA) in Cybersecurity - Mini Project: Build & Apply

Understanding Multi-factor Authentication (MFA)

📖 Scenario: You are setting up a secure login system for a small company. To protect user accounts better, you want to explain and implement the idea of Multi-factor Authentication (MFA).

🎯 Goal: Build a simple explanation and checklist for MFA factors, then create a small example list of authentication methods and mark which ones count as MFA.

📋 What You'll Learn

Create a dictionary named auth_methods with authentication methods as keys and their factor type as values

Create a list named mfa_factors containing the factor types that count for MFA

Use a dictionary comprehension to create a new dictionary mfa_methods that includes only methods using MFA factors

Add a final statement that explains the importance of MFA in simple terms

💡 Why This Matters

🌍 Real World

MFA is widely used in online banking, email services, and corporate systems to protect user accounts from unauthorized access.

💼 Career

Understanding MFA is essential for cybersecurity professionals, IT administrators, and anyone involved in securing digital systems.

1

Create authentication methods dictionary

Create a dictionary called auth_methods with these exact entries: 'Password': 'Knowledge', 'Fingerprint': 'Biometric', 'Security Token': 'Possession', 'Security Question': 'Knowledge', 'SMS Code': 'Possession'.

Cybersecurity

# Create the auth_methods dictionary with given entries
# Your code here

Hint

Use curly braces to create a dictionary with keys and values separated by colons.

2

Define MFA factor types list

Create a list called mfa_factors that contains these exact strings: 'Possession' and 'Biometric'.

Cybersecurity

auth_methods = {
    'Password': 'Knowledge',
    'Fingerprint': 'Biometric',
    'Security Token': 'Possession',
    'Security Question': 'Knowledge',
    'SMS Code': 'Possession'
}
# Create the mfa_factors list with 'Possession' and 'Biometric'
# Your code here

Hint

Use square brackets to create a list with the exact strings.

3

Filter MFA methods using dictionary comprehension

Use a dictionary comprehension to create a new dictionary called mfa_methods that includes only the items from auth_methods where the factor type is in the mfa_factors list.

Cybersecurity

auth_methods = {
    'Password': 'Knowledge',
    'Fingerprint': 'Biometric',
    'Security Token': 'Possession',
    'Security Question': 'Knowledge',
    'SMS Code': 'Possession'
}
mfa_factors = ['Possession', 'Biometric']
# Create mfa_methods dictionary with methods whose factor is in mfa_factors
# Your code here

Hint

Use {key: value for key, value in dict.items() if condition} syntax.

4

Add explanation about MFA importance

Create a string variable called mfa_explanation with this exact text: 'MFA adds extra security by requiring more than one type of authentication factor.'

Cybersecurity

auth_methods = {
    'Password': 'Knowledge',
    'Fingerprint': 'Biometric',
    'Security Token': 'Possession',
    'Security Question': 'Knowledge',
    'SMS Code': 'Possession'
}
mfa_factors = ['Possession', 'Biometric']
mfa_methods = {method: factor for method, factor in auth_methods.items() if factor in mfa_factors}
# Add the mfa_explanation string with the given text
# Your code here

Hint

Assign the exact sentence as a string to the variable.

Practice

1. What is the main purpose of Multi-factor Authentication (MFA)?

easy

A. To store user passwords securely

B. To speed up the login process

C. To replace passwords completely

D. To add extra steps to verify a user's identity

Solution

1. Step 1: Understand MFA's role in security

   MFA adds additional verification steps beyond just a password to confirm identity.

2. Step 2: Compare options to MFA purpose

   Only adding extra verification steps matches MFA's main goal.

3. Final Answer:

   To add extra steps to verify a user's identity -> Option D

4. Quick Check:

   MFA purpose = extra verification steps [OK]

Hint: MFA means more than one proof step [OK]

Common Mistakes:

• Thinking MFA speeds up login
• Believing MFA replaces passwords fully
• Confusing MFA with password storage

2. Which of the following is a common biometric factor used in MFA?

easy

A. A fingerprint

B. A username

C. A password

D. An email address

Solution

1. Step 1: Identify MFA factor types

   MFA uses factors like something you know, have, or are (biometrics).

2. Step 2: Match options to factor types

   Fingerprint is a biometric factor (something you are), common in MFA.

3. Final Answer:

   A fingerprint -> Option A

4. Quick Check:

   Biometric factor = fingerprint [OK]

Hint: Biometrics like fingerprints are MFA factors [OK]

Common Mistakes:

• Choosing username or email as MFA factors
• Confusing password as the only factor
• Ignoring biometric options

3. Consider this scenario: A user logs in with a password and then receives a code on their phone to enter. What does this example demonstrate?

medium

A. Passwordless authentication

B. Single-factor authentication

C. Multi-factor authentication

D. Biometric authentication only

Solution

1. Step 1: Analyze the authentication steps

   User provides a password (something they know) and a code from phone (something they have).

2. Step 2: Identify authentication type

   Using two different factors means this is multi-factor authentication.

3. Final Answer:

   Multi-factor authentication -> Option C

4. Quick Check:

   Password + phone code = MFA [OK]

Hint: Two different proofs mean MFA [OK]

Common Mistakes:

• Thinking it's single-factor because password is used
• Confusing with passwordless login
• Assuming biometric is required for MFA

4. A company implements MFA but users report they can log in with just a password sometimes. What is the most likely issue?

medium

A. MFA is not properly enforced on all accounts

B. Passwords are too strong

C. Users are using biometric authentication only

D. MFA requires only one factor

Solution

1. Step 1: Understand MFA enforcement

   MFA must be required for all logins to be effective.

2. Step 2: Identify why password-only logins occur

   If users can log in with just passwords, MFA enforcement is incomplete or misconfigured.

3. Final Answer:

   MFA is not properly enforced on all accounts -> Option A

4. Quick Check:

   Partial MFA enforcement = password-only logins [OK]

Hint: MFA must be enforced everywhere to work [OK]

Common Mistakes:

• Blaming password strength for MFA bypass
• Confusing biometric use with enforcement issues
• Thinking MFA can require only one factor

5. A company wants to improve security by adding MFA. They have users who often lose their phones. Which MFA method should they add to reduce login issues while keeping security strong?

hard

A. Use only passwords and skip MFA

B. Add biometric verification like fingerprint or face scan

C. Send codes only via email

D. Use security questions as the second factor

Solution

1. Step 1: Consider user phone loss impact

   Users losing phones means phone-based codes can cause access problems.

2. Step 2: Choose alternative strong factor

   Biometric verification (fingerprint/face) does not rely on phones and is secure.

3. Step 3: Evaluate other options

   Passwords alone are weak, email codes less secure, security questions often guessable.

4. Final Answer:

   Add biometric verification like fingerprint or face scan -> Option B

5. Quick Check:

   Biometrics reduce phone dependency and keep security strong [OK]

Hint: Biometrics help when phones are lost [OK]

Common Mistakes:

• Skipping MFA to avoid inconvenience
• Relying on email codes which can be intercepted
• Using weak security questions as second factor