Authentication Factors Explained: Know, Have, Are and CER for Security+

Authentication answers one question: are you who you claim to be? Every method of answering it falls into one of a small number of categories, and CompTIA expects you to classify any given method on sight.

Something you know, something you have, something you are. Those are the three classic factors, and everything else is a variation or an attribute.

Identification, Authentication, Authorization, Accounting

Get this sequence straight first, because exams test the distinction and the words are easy to blur.

  • Identification — claiming an identity. Typing a username. No proof involved.
  • Authentication — proving the claim. The password, the token, the fingerprint.
  • Authorization — determining what that proven identity may do.
  • Accounting (or auditing) — recording what they did.

Together these are AAA, implemented by protocols such as RADIUS and TACACS+. A username identifies; a password authenticates; permissions authorize; logs account.

The Three Factors

Something you know — a password, PIN, passphrase, or security question. Cheap and universal, and the weakest, because knowledge can be guessed, phished, reused across sites, or shared.

Something you have — a hardware token, smart card, TOTP or HOTP authenticator app, a FIDO2 security key, or a phone receiving a push notification. Stronger, because possession is harder to steal remotely, though not impossible.

Something you are — biometrics: fingerprint, face, iris, retina, voice, vein pattern, and behavioural traits such as typing rhythm or gait. Convenient and non-transferable, with a defining weakness: biometrics cannot be changed. A compromised password is reset in seconds; a compromised fingerprint template is compromised permanently.

The Additional Attributes

CompTIA lists these alongside the three factors, and they are frequently offered as answer choices.

  • Somewhere you are — location, whether by IP geolocation, GPS, or network segment.
  • Something you do — a behavioural pattern such as signature dynamics or how you use a device.
  • Someone you know — vouching by a trusted third party, used in some web-of-trust and account recovery schemes.

Note that "somewhere you are" and "something you do" are usually described as attributes rather than true factors, because on their own they do not prove identity. They adjust confidence.

Multifactor Means Different Categories

This is the most commonly missed point on the topic, so it is worth stating bluntly.

A password plus a security question is not multifactor. Both are things you know. So is a password plus a PIN. Genuine multifactor requires factors from different categories — something you know plus something you have, for instance.

Terminology: 2FA is exactly two factors; MFA is two or more. Every 2FA implementation is MFA; not every MFA implementation is 2FA.

Biometric Performance Metrics

Three terms that appear regularly and are easy marks once understood.

  • FAR — false acceptance rate. An unauthorized person is accepted. This is the security failure and the one that matters most.
  • FRR — false rejection rate. A legitimate user is rejected. The usability failure, which drives support calls and pressure to weaken the system.
  • CER — crossover error rate. The sensitivity setting at which FAR and FRR are equal. A lower CER means a better biometric system, and it is the standard way to compare two of them.

Turning sensitivity up lowers FAR and raises FRR; turning it down does the reverse. The CER is where they meet, which is why it is the single comparable figure.

Not All Factors Are Equal

A hierarchy worth knowing, because exams increasingly ask for the strongest option rather than just a valid one:

  1. Password alone — weakest.
  2. SMS codes — better than nothing, but vulnerable to SIM swapping and interception. NIST has discouraged them for years.
  3. TOTP authenticator apps — solid, but phishable, because the user can be talked into typing the code into a fake site.
  4. Push notifications with number matching — resistant to simple MFA fatigue attacks.
  5. FIDO2, WebAuthn and passkeys — phishing-resistant, because the credential is cryptographically bound to the legitimate domain and simply will not work on a lookalike site.

If a question asks for phishing-resistant MFA, the answer is FIDO2 or a hardware security key — never an authenticator app.

Security+ (SY0-701) Exam Tips

  • Classify any method into know, have, or are. The most likely question type.
  • Multifactor requires different categories. Password plus security question is single-factor.
  • Know the attributes: somewhere you are, something you do, someone you know.
  • FAR, FRR and CER — and that lower CER is better.
  • Biometrics cannot be reissued once compromised.
  • FIDO2 and passkeys are phishing-resistant; TOTP and SMS are not.
  • Identification, authentication, authorization, accounting — in that order.
  • Related concepts: single sign-on, federation, Kerberos, and conditional access.

CySA+ and A+ Angles

CySA+ (CS0-004) looks at authentication telemetry: detecting MFA fatigue, spotting legacy protocols used to bypass MFA, and investigating a successful login that followed a burst of failures.

A+ (220-1201/1202) keeps it practical — enrolling biometrics, configuring screen locks, setting up an authenticator app, and troubleshooting a fingerprint reader that stops recognizing a user.

Key Takeaways

  • Three factors: something you know, have, and are.
  • Multifactor means different categories, not just two prompts.
  • Biometrics are convenient and permanent — a compromised template cannot be reissued.
  • Lower CER means a better biometric system.
  • Only FIDO2, WebAuthn and passkeys are phishing-resistant.
  • Identification claims, authentication proves, authorization permits, accounting records.

Comments

Post a Comment