Authentication Methods: Passwords, MFA, Biometrics

Authentication Fundamentals

Authentication is the process of verifying a user's claimed identity before granting access to systems and data. For CISA candidates, understanding authentication methods and their relative strengths is essential because weak authentication is a primary vector for unauthorized access. Auditors must evaluate whether authentication mechanisms are appropriate for the sensitivity of the systems and data they protect.

Authentication factors are typically categorized into three types: something you know (knowledge), something you have (possession), and something you are (inherence). Strong authentication combines multiple factors from different categories.

Password-Based Authentication

Passwords remain the most common authentication method, but they are also among the weakest when poorly managed. Effective password controls include:

Complexity requirements: Minimum length (at least 12 characters recommended), character variety, and prohibition of common passwords
Password history: Preventing reuse of recent passwords to limit the impact of compromised credentials
Account lockout: Temporarily disabling accounts after a defined number of failed login attempts
Secure storage: Hashing passwords with strong algorithms (bcrypt, scrypt, Argon2) and using unique salts
Password managers: Encouraging or mandating the use of password managers to support unique, complex passwords

Auditors should evaluate password policies, test enforcement mechanisms, and review whether default or shared passwords exist in the environment.

Multi-Factor Authentication (MFA)

MFA requires users to present two or more authentication factors from different categories. Common MFA implementations include:

SMS or email codes: One-time codes sent via text message or email (considered less secure due to interception risks)
Authenticator applications: Time-based one-time passwords (TOTP) generated by mobile applications
Hardware tokens: Physical devices that generate one-time codes or use cryptographic challenge-response
Push notifications: Approval prompts sent to registered mobile devices
FIDO2/WebAuthn: Phishing-resistant authentication using hardware security keys or platform authenticators

Auditors should verify that MFA is required for high-risk access such as remote connections, administrative accounts, and access to sensitive data. The audit should also assess whether MFA recovery procedures are secure and do not bypass the intended security controls.

Biometric Authentication

Types of Biometrics

Biometric authentication verifies identity based on unique physical or behavioral characteristics:

Fingerprint recognition: Widely adopted, relatively low cost, and well understood
Facial recognition: Non-contact verification using camera-based analysis
Iris or retina scanning: Highly accurate but more expensive to implement
Voice recognition: Speaker verification based on vocal characteristics
Behavioral biometrics: Keystroke dynamics, gait analysis, or mouse movement patterns

Biometric Performance Metrics

Auditors should understand key biometric performance metrics: the False Acceptance Rate (FAR), which measures how often unauthorized users are incorrectly accepted; the False Rejection Rate (FRR), which measures how often legitimate users are incorrectly denied; and the Crossover Error Rate (CER), which represents the point where FAR and FRR are equal and serves as an overall accuracy indicator.

Audit Considerations

IS auditors should evaluate whether authentication methods are proportionate to the risk level of the protected resources, whether authentication logs capture sufficient detail for investigation, and whether authentication bypass procedures (such as password resets) maintain adequate security. Testing should include verification that authentication policies are consistently enforced across all access paths.