AP® Cybersecurity · Unit 4: Securing Devices · Topic 4.2
Authentication
Authentication is the process of verifying that a user, device, service, or system controls an authenticator linked to a claimed identity. It answers, with a chosen level of confidence, “Is this claimant really the account or system it claims to be?”
Identification, authentication, and authorization
Access control is a sequence, not one decision. A system must know which identity is being claimed, verify that claim, and then decide what that verified identity is allowed to do.
- IdentificationThe claimant states an identity: a username, email address, device certificate name, or service account ID. Identification alone proves nothing.
- AuthenticationThe claimant proves control of one or more authenticators bound to that identity, such as a password plus a security key.
- AuthorizationPolicy decides which files, applications, actions, or network resources the authenticated identity may access.
Authentication is not perfect certainty
Each method provides evidence with strengths and limits. Risk, data sensitivity, device trust, transaction value, location, and unusual behavior can determine how much assurance or reauthentication is needed.
Authentication factors
A factor is the type of evidence used in authentication. Current NIST digital-identity guidance formally uses knowledge, possession, and biometric factors. Location and behavior are commonly taught as additional categories, but they are often risk signals that strengthen a decision rather than independent authenticators by themselves.
| Factor | Examples | Main limitation |
|---|---|---|
| Something you know | Password, passphrase, or PIN. | Can be guessed, phished, observed, reused, or exposed by malware. A password and PIN are still the same factor type. |
| Something you have | Security key, smart card, authenticator device, phone, hardware token, or device-held private key. | Can be lost or stolen; secure activation, revocation, backup authenticators, and recovery are essential. |
| Something you are | Fingerprint, face, iris, or another biometric characteristic. | Biometric comparison is probabilistic, affected by presentation attacks and accessibility, and difficult to replace if compromised. |
| Somewhere you are | Approximate location, trusted network, or expected region. | Location can be inaccurate or manipulated and is usually contextual evidence rather than sufficient proof alone. |
| Something you do | Typing rhythm, pointer movement, gait, or interaction pattern. | Behavior changes and can be imitated; it is commonly used for continuous risk assessment rather than sole authentication. |
Two steps are not always two factors
A password followed by a PIN uses two knowledge secrets, so it is still single-factor authentication. MFA requires evidence from at least two distinct factor types—for example, a password plus a security key, or a device-held credential activated by a fingerprint.
Common authentication methods
Passwords, passphrases, and PINs
Passwords are centrally verified secrets; a device PIN often stays local and unlocks a stored key. Favor unique, long passwords or passphrases, a password manager, and breached-password screening. Change a password promptly when compromise is suspected.
Security keys, smart cards, and tokens
These prove control of a physical authenticator or cryptographic key. Hardware security keys and smart cards can support phishing-resistant protocols; simple code-generating tokens do not automatically resist phishing.
Fingerprints and facial recognition
Biometrics commonly unlock a device-held authenticator locally. Good systems include presentation-attack detection, retry limits, protected templates, and an accessible fallback. A biometric is not a secret like a password.
Single-factor, 2FA, and MFA
Single-factor authentication
Uses one factor type, even if the user provides two items of that same type. It is easier to deploy but a single successful theft, guess, or compromise may be enough.
Two-factor authentication (2FA)
Uses exactly two distinct factor types. It is a form of multifactor authentication. Example: a password plus possession of a registered security key.
Multifactor authentication (MFA)
Uses two or more distinct factors, sometimes within one multifactor authenticator. MFA reduces dependence on a password, but strength still depends on the method and recovery path.
Risk-based or adaptive checks
Systems may use device, location, time, behavior, or transaction context to request stronger proof. These signals can improve detection but raise privacy, fairness, and false-positive concerns.
| Method | How it works | Benefit | Limitation |
|---|---|---|---|
| Authenticator-app OTP | An app generates a short-lived one-time password from a protected seed and changing value. | Does not depend on cellular delivery and limits simple password reuse. | A fake site can still capture and immediately relay an OTP; it is not phishing-resistant. |
| Push approval | A registered app asks the user to approve a sign-in, preferably showing number matching and context. | Convenient and can display device or location information. | Users may approve fraudulent or repeated prompts; never approve an unexpected request. |
| SMS code | A short-lived code is delivered to a registered phone number. | Widely available and generally stronger than a password alone. | Messages and phone numbers can be redirected, intercepted, phished, or unavailable. Prefer stronger options when offered. |
| Recovery code | A pre-generated, single-use secret restores access when a primary authenticator is unavailable. | Provides an offline fallback. | Anyone who steals the code may use it; store it securely and never share it in response to a message. |
Passwordless authentication and passkeys
Passwordless authentication verifies a claimant without a traditional password sent to the service. It is a broad category: an emailed magic link, an OTP, a security key, and a passkey can all be called passwordless, but they do not provide equal protection.
A passkey is a WebAuthn-based public-key credential scoped to a specific website or application. The service stores a public key; the authenticator controls the related private key and signs a fresh challenge. A local PIN or biometric may authorize the authenticator to use that key.
Passwordless does not automatically mean MFA
Assurance depends on the authenticator, whether user verification is required, how keys are protected or synchronized, and how recovery works. A weak recovery route can undermine an otherwise strong sign-in method.
Single sign-on, federation, sessions, and recovery
Single sign-on (SSO)
SSO lets one authentication event provide access to multiple approved applications. It reduces password repetition and centralizes policy, but a compromised SSO account can affect many services. Strong MFA, monitoring, least privilege, and rapid revocation matter.
Federated identity
Federation lets an identity provider authenticate a user and send a protected assertion to a separately administered relying party. The relying party trusts the agreed identity relationship instead of maintaining the user’s password itself.
Sessions
After authentication, a service uses a session secret or token to maintain continuity. Timeouts, reauthentication for sensitive actions, secure cookies, logout, revocation, and device awareness limit the value of a stolen session.
Account recovery
Recovery binds new authenticators or restores access. It should verify the account holder at an appropriate assurance level, notify them of changes, protect recovery codes, and revoke lost or replaced authenticators.
Protective account controls
| Control | Purpose | Design consideration |
|---|---|---|
| Rate limits and account lockouts | Slow or stop repeated guesses. | Permanent or easily triggered lockouts can cause denial of service; progressive delays and risk signals may be safer. |
| Login and change alerts | Notify users of new devices, recovery attempts, factor changes, and suspicious sign-ins. | Alerts must contain useful context and a trusted reporting path without exposing secrets. |
| Session timeouts | Limit how long an inactive or old session remains usable. | Higher-risk resources and shared devices need shorter or more frequent reauthentication. |
| Backup authenticators | Reduce lockout if a primary device is lost. | Every backup is another access path and must be inventoried, protected, and revocable. |
| Recovery verification | Confirm identity before resetting credentials or binding a new factor. | Knowledge questions and email-only recovery may be guessable or compromised; avoid making recovery weaker than normal login. |
Common authentication attacks and defenses
The goal is recognition and defense—not reproduction. A single alert may be innocent; correlated identity, device, session, and network evidence makes an investigation stronger.
Credential stuffing uses username-password pairs exposed elsewhere against other services. Unique passwords, password managers, MFA, breached-password blocking, and alerts reduce risk.
Password spraying tries a small set of common passwords across many accounts. Monitor distributed failures and weak-password use; rate-limit intelligently and require stronger authentication.
Brute-force attempts make many guesses against an account or authenticator. Long secrets, rate limiting, lockout controls, MFA, and monitoring make guessing less effective.
Phishing uses an impostor message or site to steal passwords, OTPs, recovery codes, or approvals. Verify the origin and destination; prefer phishing-resistant authentication.
Push bombardment sends unexpected approval prompts hoping the user accepts one. Deny, report, and use number matching or phishing-resistant MFA where available.
Stolen session tokens may let an attacker continue an already authenticated session without the password. Secure endpoints, short appropriate lifetimes, reauthentication, revocation, and anomaly monitoring help.
Recovery abuse targets help desks, backup email, phone numbers, codes, or security questions. Use consistent verification, trained staff, change alerts, delays for high-risk changes, and audited procedures.
Presentation and matching attacks target biometric sensors or templates. Use liveness or presentation-attack detection, protected local comparison, retry limits, and an alternative method.
Strong password and passphrase practices
- Use a unique password for every account; a password manager can generate and store them.
- Prefer length and memorability for secrets you must remember. Multiword passphrases can help.
- Avoid common, expected, or compromised passwords and predictable personal details.
- Do not share passwords, OTPs, recovery codes, or security-key approvals. Legitimate support staff should not request them.
- Change a password when compromise is suspected or confirmed; arbitrary frequent changes can encourage predictable patterns.
- Enable the strongest practical MFA or passkey option and register a protected backup method.
Authentication in the real world
School account
A student identifies with a school email, authenticates with a passphrase and registered authenticator, and is authorized to submit their own work—but not edit another student’s grades.
Mobile device
A fingerprint locally unlocks a device-held credential. After several failures, the phone requires the device PIN. The biometric and possession of the phone work together.
Website
A passkey signs a fresh, site-specific challenge. A look-alike phishing site cannot request the legitimate site’s credential through a conforming WebAuthn flow.
Workplace
SSO connects staff to approved apps, but administrators use stronger authentication, shorter sessions, and separate privileged accounts because their possible impact is greater.
Cloud service
A federated identity provider authenticates the user, while the cloud application authorizes access based on role. Both sides log events so suspicious changes can be investigated.
Lost authenticator
The user reports the loss through a known channel. The service verifies recovery appropriately, revokes the old authenticator and sessions, binds a new method, and sends change alerts.
Watch: authentication in action
While watching, identify one factor, one attack the method helps resist, and one limitation that still requires another control.
Interactive knowledge check
Proof Quest
Choose the strongest defensive answer. The quiz runs in your browser and collects no personal information.
What the quiz covers
Identification, authentication, and authorization; factor types; SFA, 2FA, and MFA; passwords, OTPs, SMS, biometrics, passkeys, SSO, federation, sessions, recovery, common attacks, and protective controls.
How scoring works
There are 10 questions worth one point each. Answer every question, select Check my answers, review each explanation, and restart whenever you want another attempt.
AP® Cybersecurity study support
Authenticator
A means of proving control or possession of one or more authentication factors.
Claimant
A person or system presenting evidence to be authenticated.
Relying party
A service that relies on an authentication or federated identity result.
Identity provider
A service that authenticates identities and may issue protected assertions to other services.
Phishing resistance
A protocol property that prevents useful secrets or outputs from being disclosed to an impostor service.
Reauthentication
Fresh authentication required after time, inactivity, elevated risk, or a sensitive action.
Exam reasoning pattern
Identify the claimed identity, authenticator and factor type; decide whether factors are distinct; evaluate phishing and recovery risk; then separate authentication from authorization and session protection.
Continue studying
Explore RevisionTown computer science resources, connect public-key authentication with the cryptography guide, or organize practice using the AP® self-study guide.
Frequently asked questions
1. What is authentication in cybersecurity?
Authentication verifies that a claimant controls one or more authenticators bound to a claimed user, device, service, or system identity before access decisions are made.
2. How is authentication different from authorization?
Authentication verifies identity evidence. Authorization uses policy to decide what the authenticated identity may access or do.
3. Is a password plus a PIN two-factor authentication?
No. Both are “something you know,” so they represent one factor type. Two-factor authentication requires two distinct types of evidence.
4. Are authenticator-app codes phishing-resistant?
No. They are short-lived and useful, but a convincing fake site can capture and relay them. WebAuthn-based authentication offers stronger phishing resistance.
5. Is SMS authentication useless?
No. SMS can be better than password-only login, but phone-number redirection, message interception, phishing, and availability make stronger methods preferable when supported.
6. Can biometrics replace every password?
No. Biometrics are probabilistic, difficult to replace, and require protected sensors, templates, retry limits, presentation-attack defenses, and an accessible fallback.
7. What is a passkey?
A passkey is a WebAuthn-based public-key credential scoped to a relying party. An authenticator signs a challenge with a private key, while the service verifies it with the public key.
8. What is the difference between SSO and federation?
SSO describes access to multiple applications after one authentication event. Federation is a trust arrangement in which one identity provider supplies protected identity assertions to separately administered relying parties.
9. Why are account-recovery procedures important?
Recovery can reset access or bind a new authenticator. If it is weaker than normal login, attackers may target it instead of the primary authentication method.
10. What should I do after an unexpected login alert?
Use the service’s official app or a known URL to review sessions and account changes. Report suspicious activity, revoke unknown sessions, and secure credentials through the trusted recovery process.
Trusted references
AP® is a trademark registered by the College Board, which is not affiliated with and does not endorse this page. This lesson provides defensive cybersecurity education. Authentication testing, account changes, recovery, session management, and identity investigation must be authorized and follow applicable policies, privacy requirements, and law.
