Page 135 - CISSO_Prep_ Guide

person offering that ID - not just an imposter or attacker. This is
the process of authentication.

There are three primary methods of authentication in use today,
knowledge-based, ownership-based, and characteristic
(biometric-based) systems. No single form of authentication is
considered trusted on its own since each type of authentication
can be bypassed. Therefore, all authentication implementations
in use today recommend the use of at least two of the three
factors (knowledge, ownership, characteristic). The use of two
of the same factors (a pin and a password) is not considered to
be two-factor authentication.

Knowledge
Knowledge-based authentication uses a "secret" value as the
authentication method. The most version of this is a password-
based system that requires the user to know the confidential
password to authenticate themselves to the system. The problem
with a password-based system is the threat of replay attacks.
Since the password remains the same over some time, an
attacker that learns the "static" password would be able to log in
as the legitimate user at a later date/time. Ideally, the password
should be set up according to good password rules. A mix of
upper and lower case letters, numbers, special characters, and
not be repeated or reused.

Other forms of knowledge-based systems use Personal
Identification Numbers (PINs), secret questions (although in
many cases the question can be answered through a quick
Google or Facebook search), and graphical passwords where the
user selects an image that they associate with.