L3. Authentication: Passwords, MFA, SSO & Biometrics
Course outlineLesson 3 of 20
Authentication is how systems verify identity before granting access. The Security+ exam tests your knowledge of authentication factors, federation protocols, and the trade-offs between security and usability.
Authentication Factors
Authentication factors fall into three categories. Multi-factor authentication (MFA) requires two or more from different categories.
| Factor | Category | Examples |
|---|---|---|
| Something you know | Knowledge | Password, PIN, security question |
| Something you have | Possession | TOTP app, hardware token, smart card |
| Something you are | Inherence | Fingerprint, face scan, iris scan |
Password Security
Passwords are the most common authentication factor and the most attacked. Key controls:
- Length over complexity: a 16-character passphrase is stronger than an 8-character complex password
- Salted hashing: never store plaintext passwords; use bcrypt or Argon2 with a unique salt per user
- Account lockout: limit failed attempts to slow brute force
- Password managers: encourage use rather than password reuse
Single Sign-On (SSO) and Federation
SSO lets users authenticate once and access multiple systems. Key protocols: SAML 2.0: XML-based; used for enterprise federation between organizations (e.g., corporate IdP to a SaaS app). Produces assertions. OAuth 2.0: An authorization framework, not an authentication protocol. Grants delegated access to resources without sharing credentials. OpenID Connect (OIDC): Authentication layer built on top of OAuth 2.0. Adds identity tokens (JWT) to OAuth's access tokens.
Biometrics
Biometric systems have two key error rates:
- FAR (False Acceptance Rate): system accepts an unauthorized user. Lower FAR = harder for attackers.
- FRR (False Rejection Rate): system rejects a legitimate user. Lower FRR = better usability.
- CER (Crossover Error Rate): the point where FAR equals FRR. Lower CER = more accurate system overall.
- ✓MFA requires two or more factors from different categories: knowledge, possession, inherence
- ✓SAML 2.0 is for federated authentication between organizations; OIDC adds authentication on top of OAuth 2.0
- ✓OAuth 2.0 is an authorization framework, not an authentication protocol
- ✓CER (Crossover Error Rate) is where FAR equals FRR; lower CER means a more accurate biometric system
- ✓Salting passwords with bcrypt/Argon2 prevents rainbow table attacks and slows brute force
1. A user authenticates with a password and then approves a push notification on their phone. Which MFA factor categories are being used?
2. Which protocol should a security architect choose to enable federated authentication between a corporate identity provider and a SaaS application?
3. A biometric system has a FAR of 0.001% and a FRR of 5%. What does this indicate about the system?
Recommended: Pluralsight
Turn your CompTIA Security+ concepts into passing marks: Pluralsight adds structured study plans, practice exams, and hands-on scenario labs.