Chapter 4 — Reviewing authentication
Lesson map
Lesson 04 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Current state"]
N2["4.2 Comparing with guidance"]
N3["4.3 Proposals"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Current state"]
N2["4.2 Comparing with guidance"]
N3["4.3 Proposals"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX016"]
[Learning outcomes]
|
v
[4.1 Current state]
|
v
[4.2 Comparing with guidance]
|
v
[4.3 Proposals]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) assess authentication settings; (2) identify weak methods; (3) propose improvements.
4.1 Current state
Daniel reviews authentication settings. Multi-factor authentication is enabled but optional, and 41 of 60 staff use it. Text message codes are the most common method. The password policy forces changes every 45 days and requires symbols. Two partners and the office manager have no second factor at all. He records each setting with the export that shows it. A clear picture of the current state lets him compare it with guidance and explain differences to partners without relying on opinion.
Forty-one of sixty is about 68 percent, and the gap includes two partners, whose accounts are among the most valuable to an attacker.
4.2 Comparing with guidance
NIST SP 800-63B favours longer passwords screened against known-compromised lists, without forced periodic changes unless compromise is suspected, and treats text codes as a restricted method. Phishing-resistant authenticators, such as passkeys built on WebAuthn, give the strongest protection. Daniel notes that forced 45-day changes tend to produce predictable passwords, and that partners without a second factor are the highest-value targets because they can see every client's records and approve payments. He summarises the comparison in a short table showing each setting, the guidance and the gap, with the export that proves the current value.
4.3 Proposals
Daniel proposes: require multi-factor authentication for all staff within a month; partners, the office manager and IT move to passkeys or hardware keys first; text codes allowed only as a temporary fallback; remove forced periodic changes and add screening of new passwords against compromised lists. Each proposal states the risk reduced, effort and staff impact. Helen reviews them before he presents to the managing partner, who approves all four with a request for drop-in help sessions. The approved proposals and dates are recorded.
Worked example
MFA is optional and used by 41 of 60; two partners and the office manager have none; four proposals are approved.
Synthetic case. Settings and counts are synthetic; NIST SP 800-63B and W3C WebAuthn are real sources.
Errors and limits
Leaving MFA optional lets the highest-value accounts remain unprotected.
Exercises
- EX016 — Starting coverage. How many staff used MFA at the start? Rubric: 3 = 41 of 60;; 2 = 41;; 1 = 60;; 0 = none.
- EX017 — Unprotected seniors. Who had no second factor? Rubric: 3 = two partners and the office manager;; 2 = seniors;; 1 = nobody;; 0 = none.
- EX018 — Forced change issue. Why remove forced 45-day changes? Rubric: 3 = produce predictable passwords;; 2 = predictable;; 1 = security;; 0 = none.
- EX019 — SMS status. How are text codes treated? Rubric: 3 = temporary fallback only;; 2 = fallback;; 1 = main method;; 0 = none.
- EX020 — Partner request. What did the managing partner request? Rubric: 3 = drop-in help sessions;; 2 = help sessions;; 1 = vague;; 0 = none.
Synthesis
Comparing settings with guidance and proposing ranked changes strengthens authentication with partner support.
Continue studying — chapter 04 of 12
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →