Prevention Methods: Authentication (Passwords, Biometrics, Two-Factor)

This lesson covers authentication as a network security prevention method, as required by OCR J277 Section 1.4. Authentication is the process of verifying that a user or device is who they claim to be.

---

What Is Authentication?

Authentication is the process of confirming the identity of a user before granting access to a system, network, or resource. It answers the question: "Are you really who you say you are?"

Authentication is different from authorisation:

• Authentication = verifying identity (who are you?)
• Authorisation = granting permissions (what are you allowed to do?)

A user must be authenticated before they can be authorised.

---

The Three Factors of Authentication

Authentication methods are based on three factors:

Factor	Description	Example
Something you know	Information only the user should know	Password, PIN, security question
Something you have	A physical item the user possesses	Smart card, phone (for SMS codes), security token
Something you are	A biological characteristic unique to the user	Fingerprint, facial recognition, iris scan

OCR Exam Tip: The three authentication factors are a common exam question. Remember them as: know, have, are. Two-factor authentication uses at least two of these three categories.

---

Passwords

Passwords are the most common form of authentication. The user enters a secret string of characters that must match what is stored (in hashed form) on the system.

Characteristics of strong passwords:

Feature	Weak Password	Strong Password
Length	4-6 characters	12+ characters
Character types	Lowercase only	Mix of upper, lower, numbers, symbols
Predictability	Common words (password123)	Random or complex phrases
Reuse	Same password on multiple sites	Unique password for each account

Password vulnerabilities:

• Brute force attacks — trying every combination
• Dictionary attacks — trying common words and passwords
• Phishing — tricking users into revealing passwords
• Shoulder surfing — observing password entry
• Data breaches — stolen password databases

Password best practices:

• Use a minimum of 8-12 characters (longer is better)
• Include uppercase, lowercase, numbers, and special characters
• Do not reuse passwords across different accounts
• Use a password manager to generate and store complex passwords
• Change passwords regularly
• Never share passwords with others

---

Biometrics

Biometric authentication uses unique physical or behavioural characteristics to verify identity.

Types of biometric authentication: