Domain 5 · Lesson 1 of 5
Authentication Factors & MFA
Nhân tố Xác thực & Đa yếu tố
The 4 A's — In Sequence
1. Identification
Claim identity (username, card swipe)
2. Authentication
Prove the claim (password, OTP, biometric)
3. Authorization
Grant permitted access (RBAC, ABAC)
4. Accountability
Audit trail (logs, session recording)
Three Authentication Factor Types
| Type | Tiếng Việt | Examples | Weakness |
|---|---|---|---|
| Type 1: Know | Điều bạn biết | Password, PIN, passphrase, security question | Phishing, keylogging, shoulder surfing |
| Type 2: Have | Điều bạn có | SMS OTP, TOTP app, hardware token, smart card, YubiKey | SIM swap (SMS), theft |
| Type 3: Are | Điều bạn là | Fingerprint, face, iris, retina, voice, vein | Spoofing (need liveness detection) |
MFA RULE: Must combine 2+ DIFFERENT factor types
- • Phone number + SMS OTP = ONLY Type 2 (not true MFA — same factor type twice)
- • Password + OTP = Type 1 + Type 2 = true MFA ✓
- • Partner E MPIN + biometric = Type 1 + Type 3 = true MFA ✓
Biometric Accuracy Metrics
FAR — False Accept Rate
Wrong person gets in. Security risk. Also called Type II error or False Positive in security context.
FRR — False Reject Rate
Right person locked out. Usability risk. Also called Type I error.
CER / EER — Crossover Error Rate
Point where FAR = FRR. Lower CER = more accurate system.
FAR and FRR trade off against each other — tightening sensitivity reduces FAR but increases FRR. CER is the single number used to compare biometric systems: a system with CER 1% is more accurate than one with CER 5%.
NIST SP 800-63A — Identity Proofing Levels
Identity proofing = verifying that a person IS who they claim to be before issuing credentials. Three levels of assurance:
| Level | Name | Process | Use Case |
|---|---|---|---|
| IAL1 | Identity Assurance Level 1 | Self-assertion only — no identity verification. Applicant states their own identity. | Low-risk accounts, anonymous services |
| IAL2 | Identity Assurance Level 2 | Remote or in-person identity proofing with identity evidence (government ID). Document validation + biometric comparison. | Financial accounts, most government services |
| IAL3 | Identity Assurance Level 3 | In-person identity proofing by trained representative. Physical document inspection. Highest assurance. | High-value government clearances, banking |
Non-Person Entities (Service Accounts, API Keys, IoT Devices)
Authentication extends beyond humans: Service accounts = authenticated via client certificates or OIDC federation (not passwords); API keys = Type 2 factor (something you HAVE) — must be rotated and stored in Vault; IoT devices = device certificates, hardware TPM attestation. All non-person entities should have unique identities with least privilege.
FinTech Company X: Platform C microservices use mTLS client certificates for service-to-service auth (Type 3 equivalent for services). Partner D B2B partner uses HMAC-signed requests (API key equivalent). All secrets managed in HashiCorp Vault with auto-rotation.
Password Best Practices — NIST SP 800-63B
Recommended ✓
- ✓ Prioritize length over complexity (passphrases)
- ✓ Check against breached password lists (HaveIBeenPwned)
- ✓ Allow paste in password fields
- ✓ Store with bcrypt / Argon2 / scrypt (slow + salted)
Avoid ✗
- ✗ Mandatory periodic changes unless compromised
- ✗ Arbitrary complexity rules (special chars, caps)
- ✗ MD5 or SHA-1 for password hashing (fast = bad)
- ✗ Blocking paste (forces weaker passwords)
Key Terms
- MFA requires DIFFERENT factor types — same type twice is NOT MFA (phone number + SMS OTP = only Type 2).
- FAR = security risk (lets wrong person in); FRR = usability risk (locks right person out).
- Lower CER = more accurate biometric system.
- NIST 800-63B recommends length over complexity — do NOT force periodic changes unless compromised.
- FIDO2/WebAuthn = phishing-resistant MFA — asymmetric key pair on device, private key never leaves device.
Partner E biometric MFA: MPIN (Type 1) + biometric face scan (Type 3) = true MFA. eKYC Vendor liveness detection prevents photo spoofing and video replay attacks — essential because face data can be photographed.
OTP rate limiting: OTP capped at 5/hr per phone number prevents Type 2 brute force. Anti-enumeration: OTP always sent regardless of account existence — prevents attackers from discovering valid accounts by observing different responses.
Recommendation: Upgrade Partner C from SMS OTP (Type 2, SIM-swap risk) to TOTP app option (Authenticator app) for users who prefer stronger Type 2 authentication without SIM-swap exposure.
Practice Quiz
Q1. A user logs in with their phone number and then receives an SMS OTP. Is this true MFA?
▼ Reveal Answer
Q2. Partner E uses MPIN plus biometric face scan. Which factor types are used, and is this true MFA?
▼ Reveal Answer
Q3. Which biometric error rate represents a security risk — FAR or FRR?
▼ Reveal Answer
Q4. What does CER measure, and what does a lower CER indicate about a biometric system?
▼ Reveal Answer
Q5. Liveness detection — what specific attack does it prevent in the context of biometric authentication?