The next step in the identification process is authentication.
A person has said who they are,
now we have to prove that they truly are that person.
We could say that authentication is to verify,
validate, or prove the identity,
and this could be through things like a proof of possession or a secret
question like we looked at back with the identification as most commonly
based on three different types of authentication,
what you know, such as a password, what you have,
or what you are.
We can see here that with authentication,
what you know is based on something like a password,
passphrase, or a secret question.
The problem with this is that these are usually static values.
The password may remain the same for 30 days or more,
which means that if somebody was able to learn our password,
they could replay that password and get access to our system.
So that's why they often say that passwords should
be changed on a periodic basis.
They should also be different for different systems so you don't
end up if a password was compromised on one system that that
password would also be used on other systems and the person could
get access to those as well.
The next form of authentication is based on possession,
ownership, in other words, what you have,
such as do you have the right employee ID badge to
give you access to the building?
Do you have some type of a token or key fob smartcard,
or to get into a country, a passport that validates who you are?
The third form of authentication is based on what you are.
This, of course, is commonly known as biometrics,
and there are two types of biometrics, behavioral and physiological.
Behavioral biometrics are things like how do you speak, a voice print.
How do you sign your name?
Signature dynamics,
which is more related actually to the acceleration as you move across the page,
not the signature itself.
And keystroke dynamics.
Everybody types a little bit differently.
They have a different delay rate and transfer rate as they
hold down a key and move between keys.
Physiological biometrics we're usually more familiar with,
things like an iris scan looking at the colored
portion around the pupil of the eye,
the retina scan that looks at the pattern of blood
vessels in the back of the eye,
a palm print which quite often looks at not only the lines on our hand,
but also can look at the blood vessels that are underneath the skin,
that's why we call it a venous scan, or of course,
a fingerprint.
We've seen a lot of systems based on things like face ID or facial recognition.
These are all characteristics of a person.
Biometrics have a few challenges.
Users can be concerned about privacy, cleanliness of the device,
am I going to put my hand on that, the delay it takes to process,
how long am I going to have to wait until the
system recognizes me and lets me in,
as well as the cost to install this equipment and also to
set up all the registration of each user and the
maintenance of the system as well.
Node authentication is a little bit different.
It's a type of authentication that recognizes a trusted device,
a trusted computer, for example,
and this could be based on anything from an IP address,
a MAC address of the system, or an RFID,
radio‑frequency identifier tag that's onto that device.
The key points review.
Authentication is the next step after identification.
We validate the identity based on those three factors,
what you know, what you have, and what you are.
In many cases,
we'll use a combination of at least two of these together, and that is what we
call multifactor or sometimes known as strong authentication.