In this lesson, we're going to cover authentication.
Authentication in cybersecurity is a security measure
that ensures individuals
or entities are who they claim to be
during a communication or transaction.
Basically, authentication focuses
on verifying the identity of individuals
or entities participating inside of a digital interaction.
Now, let's pretend you just walked out to the mailbox
and you received two different letters.
One of those letters was sent from an anonymous sender
and it claims that you owe $1,000
for a new laptop that you don't remember buying.
The other one is from your country's tax collection agency
like the IRS here in the United States,
stating that you owe them $1,000
in unpaid taxes for the last year.
Now, as you examine the IRS letter
you see something on it like the official stamp,
your real social security number
and other identifying information, as well as a field
in the form letter that states how much
and exactly when you paid your last tax bill.
Now, which of these two letters are you going to trust more?
Now, if you're like most people
you're simply going to throw away
that anonymous letter for the $1,000 laptop bill.
Instead, you're going to take that tax collection letter
a lot more seriously
because it passes your authentication test.
Now, in today's digital environment,
we don't just use images or seals to determine if somebody
is who they say they are
because that can be easily spoofed online.
But instead, we want to conduct identity verification
using various forms of authentication.
These days we have
five commonly used authentication methods.
We refer to these as something you know,
something you have, something you are, something you do,
and somewhere you are.
Now, first you have something you know.
Something you know is also called a knowledge factor
and it relies that information
that you as a user can recall.
Typically, this will be a secret word
or phrase or a password known only to you.
The most common type of knowledge factor is a username
and password combination because it's something you remember
and you're prompted to enter it
every time you log into a system.
Now, second, we have something you have.
Something you have is also known
as a possession factor, and this relies on the
user presenting a physical item to authenticate themselves.
If you've ever worked in a large office building
you may have been asked to present
your employee identification badge to a security guard
for verification whenever you try to enter the building.
This is a good example
of something you have or a possession factor.
Another good example of this is when a website
sends you a one-time text message code
over to your smartphone
that you're going to type in during the login process,
because in theory only you have possession
of your smartphone,
so your smartphone acts as the possession factor.
Third, we have something you are.
Now something you are is also known
as an inherence factor.
This relies on the user providing a unique physical
or behavioral characteristic
of the person to validate they are who they claim to be.
Often you'll hear this referred
to as biometric authentication.
For example, I use facial recognition every day
to unlock my iPhone when I want to use it
or I use my index finger to unlock my MacBook Pro
using the embedded fingerprint reader
on my laptop instead of typing in a username and password.
Fourth, we have something you do.
Now, something you do is also known
as an action factor, and it relies on the user
conducting a unique action to prove who they are.
For example, when I was a kid, my friends
and I had a secret handshake that we could use to verify
that we were part of Jason's clubhouse
and we were the ones who were allowed
to use our club's treehouse.
Similarly, I've worked
in organizations that use handwriting samples
or an analysis of how you're walking to determine
if you're authorized to perform a certain action.
Fifth, we have somewhere you are.
Somewhere you are also known as the location factor relies
on the user being in a certain geographic location
before they're granted access to a system.
For example, when my kids were younger
we used to have geofencing set
up on their phones to provide them
with a way to unlock our front door using their smartphones
but it would only work if they were
within 20 feet of our house
because we didn't want them inadvertently unlocking the door
if they were sitting a few miles away
at their friend's house.
Similarly, many companies use location-based factors
to allow or deny access to their critical applications.
I worked at one organization that would only
allow me to use certain functions
on my smartphone if I was inside the United States,
but as soon as I left the United States,
a lot of those functions would be blocked
to protect the security of the data on my device.
Now, each of these five factors can be used by themself
but you can also combine two
or more of them together to create what's known
as a multi-factor authentication system.
If you have two of these
we call this 2FA or two factor authentication.
If you have two or more of these
we can also call this MFA or multi-factor authentication.
Now, MFA or a multi-factor authentication system
is a security process that requires users
to provide multiple methods
of identification to verify their identity.
This approach ensures that even
if one factor is compromised, like a stolen username
or password, that the attacker can still not gain access
because they need a second factor, such as a hardware token,
a one-time text message code, a fingerprint,
a facial recognition scan, or something else like that.
Now, authentication is critical to understand
because it's going to be used to prevent unauthorized
access to provide user data and privacy,
and to ensure the resources are being accessed
by valid users only.
First, we need to talk about authentication being used
to prevent unauthorized access.
Given the increasing number of digital threats out there
it is truly imperative that we ensure that only
authorized individuals are accessing
our organization system and data.
By creating a solid authentication model
within your organization, your systems can effectively keep
out impersonators or malicious actors out of your network.
Just consider your online bank account.
If it didn't have stringent authentication standards
then anybody could log into your account
and steal your money.
But by using the proper authentication mechanisms
we can greatly reduce the risk of this occurring.
Second, we use authentication to protect our user data
and privacy.
By verifying users identities before granting them access,
platforms and other websites can ensure
that personal and sensitive data is only being shown
to the rightful owners or authorized individuals.
For example, your health and medical records are usually
encrypted and stored within a patient portal
and you want to ensure that only you and your doctors
can access that and view your health information
within that system to protect your privacy.
Third, and finally, we have the use of authentication
to ensure resource validity.
Now, in the digital realm where resources like cloud storage
and network bandwidth are considered to be shared resources
it becomes truly essential to ensure that only
valid, authenticated users can consume those resources.
So remember, when it comes to authentication
it really is a means to verify the identity
of users or entities inside of your digital interactions.
There are many different tools
and factors that we can use to achieve robust levels
of authentication, including knowledge factors,
possession factors, inherent factors, action factors
and location factors.
But at its core authentication ensures
that individuals are who they claim to be
and grants some access
and privileges that they're going to be entitled to.
In a digital world where identity
and access management are paramount
authentication is standing there
as a security guard to ensure the security, privacy
and proper access of your data
and resources is being achieved across the organization.