Authentication is the check that a user really is who they claim to be. Controls fall into three families: something you know (password, PIN), something you have (card, token, phone) and something you are (fingerprint, face).
This lesson sits in safety, security and effects and builds on data-protection risks, because access control is the usual answer to unwanted viewing.
How do you compare controls?
Use three questions for any pair: how easy is it to use, how easy is it to defeat, and what happens when it fails or is lost.
| Control | Family | Strength | Weakness |
|---|---|---|---|
| Password | Know | Easy to set and change | Can be guessed, shared or reused |
| PIN | Know | Quick on a device | Short, so easier to guess |
| Security token or card | Have | Cannot be guessed remotely | Can be lost or stolen |
| Fingerprint or face | Are | Convenient, hard to share | May misread; cannot be changed if leaked |
| Two-step check | Two families | Attacker needs both parts | Slower; needs the second item to hand |
Worked example
Invented case: the office of Pantai Dental Supplies (fictional) must protect a stock database. Option A is a password. Option B is a password plus a one-time code sent to the manager’s phone.
Step 1, the risk: an outsider guesses or finds the password.
Step 2, Option A: if the password leaks, the outsider is in at once.
Step 3, Option B: the outsider also needs the phone, a second family of proof, so a leaked password alone fails.
Step 4, judgement: Option B is stronger because it needs two different kinds of evidence. The cost is a few extra seconds at login and a problem if the phone is lost, so the office should keep a recovery process.
The mistake to watch for
A common slip is claiming one control is perfect.
Mistaken answer: “Fingerprints are the strongest because they cannot be stolen or copied.”
Fingerprints can be misread, and copies have been made from surfaces. Absolute words weaken a comparison.
The correction is to give a reasoned preference with a limit: “Fingerprints are convenient and hard to share, but a damaged finger may be rejected, so a backup method is needed.”
Check yourself
1. Place these in the three families: a bank card, a PIN, a face scan.
Show answer
Bank card: something you have. PIN: something you know. Face scan: something you are.
2. Why is using the same password on every account risky?
Show answer
If one service leaks the password, an attacker can try it on every other account, so a single leak opens all of them.
3. Give one advantage and one disadvantage of a PIN compared with a long password.
Show answer
Advantage: faster to enter on a device. Disadvantage: far fewer combinations, so easier to guess. For example, a four-digit PIN has 10 000 combinations.
Where this leads next
Move on to accessibility requirements in a document and revisit the practice set afterwards. The practical task and evidence checker can help when a brief asks you to protect a file with a password.
If comparison questions still feel like guesswork, a teacher in online one-to-one ICT tuition can model how to build a balanced answer in two or three sentences.