Chapter 17 — Authentication
Lesson map
Lesson 17 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Factors"]
N2["17.2 Multi-factor authentication"]
N3["17.3 Attacks"]
N4["17.4 Account recovery"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Factors"]
N2["17.2 Multi-factor authentication"]
N3["17.3 Attacks"]
N4["17.4 Account recovery"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX049"]
[Learning outcomes]
|
v
[17.1 Factors]
|
v
[17.2 Multi-factor authentication]
|
v
[17.3 Attacks]
|
v
[17.4 Account recovery]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) compare authentication factors; (2) explain multi-factor authentication; (3) recognise attacks on authentication.
17.1 Factors
Authentication confirms that someone is who they claim to be. Aisha learns three factor types: something you know, such as a password; something you have, such as a phone or hardware key; and something you are, such as a fingerprint. Each has weaknesses. Passwords can be guessed or stolen; phones can be lost; fingerprints cannot be changed if copied. Dr. Carrow explains that combining factors of different types makes attacks much harder. She lists which factors Ashfield already uses for members and staff.
17.2 Multi-factor authentication
Ashfield's online banking uses passwords plus a code sent by text message. Aisha learns that text message codes are better than passwords alone but can be intercepted through mobile number takeover. App-based codes and hardware keys are stronger. For staff remote access, she recommends app-based codes, and for IT administrators, hardware keys. She notes that member convenience matters, so changes for members need careful communication and support. She drafts a member leaflet explaining why app codes are safer, and the marketing team agrees to include it with annual statements.
17.3 Attacks
Aisha studies attacks on authentication. Phishing tricks people into entering credentials on fake sites. Credential stuffing tries usernames and passwords leaked from other services. Password guessing tries common passwords against many accounts. Prompt bombing sends repeated approval requests hoping a tired user accepts one. She learns that multi-factor authentication stops many of these, but phishing-resistant methods such as hardware keys are needed against the most capable attackers. She writes a short summary of each attack for the awareness programme, using plain language and an example message staff might see.
17.4 Account recovery
Attackers often target account recovery instead of login. If a member can reset a password by answering easily discovered questions, strong login controls are bypassed. Aisha reviews Ashfield's synthetic recovery process and finds that branch staff reset passwords after members state their date of birth and address, information often available publicly. She recommends identity documents in branch or verification through the registered phone. Dr. Carrow notes that recovery is often the weakest point. The branch managers agree to the change after a short trial.
Worked example
Aisha compares factor types, recommends app codes and hardware keys, studies phishing, stuffing and prompt bombing and strengthens weak member password recovery.
Synthetic case. Processes are synthetic.
Errors and limits
Strong login controls are bypassed if account recovery is weak.
Exercises
- EX049 — Fingerprint weakness. What is the weakness of fingerprints? Rubric: 3 = cannot be changed if copied;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX050 — Text code risk. How can text message codes be stolen? Rubric: 3 = mobile number takeover;; 2 = partly correct;; 1 = other;; 0 = none.
- EX051 — Recovery weakness. What weak recovery check did branches use? Rubric: 3 = date of birth and address;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 17 (chapter 17 of 40)
← Chapter 16 · Course chapter index · Chapter 18 →
Continue to the next authored lesson.