3.6.3 - Detecting and preventing security threats
Security measures protect different stages of using a system. Learn how passwords, biometrics, CAPTCHA, email confirmation and automatic updates work, then choose measures suited to a specific risk.
Biometrics, passwords and CAPTCHA
A system must distinguish legitimate users from people or automated programs that should not receive access.
Password systems ask for a secret associated with an account. The system checks the supplied credentials before permitting access. Strong, unique passwords are harder to guess, and changing a known default closes an obvious route into an account. A password can still be disclosed through phishing or observation; a successful password check establishes that the person supplied the secret, rather than proving how they obtained it.
Biometric measures check physical or behavioural features, such as a fingerprint or face. A phone can compare a measured feature with an enrolled reference to unlock the device. This is convenient because the user does not have to type a password in public. However, sensors can fail to recognise an authorised user, and biometric information is sensitive and difficult to replace if compromised. A device needs an appropriate recovery method as well as the everyday check.
CAPTCHA, or a similar challenge, helps distinguish human activity from automated activity. It can reduce automated account creation or repeated bot submissions. It does not establish a person's name or prove that a human has permission to access confidential files. Some challenges also create accessibility difficulties; a suitable alternative may be needed.
| Need | Relevant method | Limit |
|---|---|---|
| Unlock a mobile phone conveniently | Biometric comparison | Recognition errors and protection of biometric data matter. |
| Check an account's secret credential | Password system | A stolen or shared password can pass the check. |
| Reduce automated form submissions | CAPTCHA or similar | A human attacker may still pass. |
Email confirmation and software updates
Some measures check control of an account, while others repair weaknesses in the software itself.
Email confirmation sends a link or code to a user's registered email address. The user follows the link or enters the code to complete a registration, reset or sensitive action. This provides evidence of access to that mailbox. An attacker who knows the website password but cannot reach the confirmation email may be unable to complete the action. However, someone who compromises the email account may also obtain the code, so this is not unlimited proof of real-world identity.
Continue this lesson.
You’re previewing NovaLearn without an account. Create a free account to read the rest.
Create free account