Authentication
Authentication is how a device decides "are you really you?" In this lesson you sit at the security control panel and configure login settings that keep adversaries out.
Welcome to the AuthGuard Control Panel for AgriNova Farms. After last unit's device assessment, management wants every login locked down: the data server, the office laptops, the manager's phone app, and the IoT dashboards. Your task is to mitigate risk by choosing how users prove their identity and how the system reacts to attacks.
Authentication is the process of verifying that a user is who they claim to be. It is different from authorization (what you're allowed to do). Strong authentication rests on three pillars: safe password storage, resistance to password attacks, and multiple factors of proof.
Store Safely
Never store raw passwords. Use one-way hashes so a stolen database doesn't reveal anyone's password.
Prove Identity
Combine something you know, have, and are — multi-factor authentication beats a single password.
Harden Logins
Configure password policy, attempt limits, and account lockout to mitigate guessing attacks.
- 1Explain why hashes are used to store passwords.
- 2Explain how password attacks exploit vulnerabilities.
- 3Determine the type of authentication used to verify the identity of a user.
- 4Configure login settings to make a device more secure.
AgriNova's old system stored passwords in plaintext, allowed unlimited login attempts, and accepted weak passwords like farm123. You're handed the AuthGuard panel to fix it: turn on password hashing, set a password policy, enable multi-factor authentication, and configure account lockout after repeated failures — all on a safe, fictional system.
Big Idea
A password alone is a weak gate. Real security comes from storing secrets as hashes, requiring multiple factors, and configuring login settings that make automated guessing slow, noisy, and ultimately useless.
You'll explain why hashing protects stored passwords, classify password attacks, sort authentication into know/have/are, and configure lockout + policy settings that mitigate real risk — the AP Mitigate Risk skill.
Hashing, Password Attacks, and Factors
How passwords are stored, how attackers try to break them, and how layered factors stop them.
A hash function takes any input and produces a fixed-length output called a hash (also called a digest or, when used to verify integrity, a checksum). Hashing is one-way: you can compute the hash from a password, but you can't reverse the hash back into the password. That's exactly why systems store the hash of your password, not the password itself.
When you log in, the system hashes what you typed and compares it to the stored hash. If they match, you're in — and the real password was never kept on disk. So if the database is stolen, the adversary gets hashes, not usable passwords.
Adversaries still attack passwords. The most common password attacks:
- Brute force: try every possible combination until one works.
- Dictionary attack: try a list of common/likely passwords (
password,farm123). - Credential stuffing: reuse username/password pairs leaked from other breaches.
- Rainbow table: precomputed hash lookups to reverse unsalted hashes quickly.
- Phishing / keylogging: trick or record the user to capture the password directly.
The three authentication factors defeat most of these by requiring more than one kind of proof:
Something You Know
Password, PIN, security question. Weakest alone — can be guessed or stolen.
Something You Have
Phone code, security key, smart card. The attacker needs the physical item.
Something You Are
Fingerprint, face, voice (biometrics). Tied to the person, hard to copy.
Hash vs Plaintext Password Storage Simulator
Type a password and watch how it would be stored two ways. Notice the same input always makes the same hash — but you can't read the password from it.
Plaintext storage (insecure)
If the database leaks, the adversary reads every password instantly.
Hashed storage (secure)
One-way digest. A leak exposes this, not the password. (Demo hash for learning only.)
Terms for MCQ and Device Security Analysis
Precise definitions you'll need for multiple choice and free-response answers.
| Term | Definition | Control-Panel Example |
|---|---|---|
| Authentication | Verifying a user is who they claim to be. | Logging in to the AuthGuard panel. |
| Hash / digest | Fixed-length, one-way output of a hash function. | Stored instead of the raw password. |
| Checksum | A hash used to verify data hasn't changed (integrity). | Confirms a firmware file wasn't tampered with. |
| Salt | Random data added before hashing so identical passwords hash differently. | Defeats rainbow tables. |
| Brute force attack | Trying every possible password combination. | Blocked by lockout + limits. |
| Dictionary attack | Trying lists of common/likely passwords. | Blocked by strong password policy. |
| Credential stuffing | Reusing leaked username/password pairs. | Blocked by MFA + unique passwords. |
| Multi-factor authentication (MFA) | Requiring two or more different factor types. | Password + phone code. |
| Account lockout | Disabling login after repeated failures. | Lock after 5 failed attempts. |
| Password policy | Rules for password length, complexity, and reuse. | 12+ chars, mixed types required. |
| Factor | What it is | Examples |
|---|---|---|
| Something you know | Information only the user should have. | Password, PIN, security question. |
| Something you have | A physical item the user possesses. | Phone authenticator code, security key, smart card. |
| Something you are | A physical/behavioral trait (biometric). | Fingerprint, face scan, voice. |
What the Exam Wants You to Explain
Skill in focus: Mitigate Risk — choose and configure controls that reduce the chance or impact of an attack.
For authentication, a complete AP answer: (1) names the threat (e.g., brute-force guessing), (2) names the control that mitigates it (e.g., account lockout + MFA), and (3) explains how the control reduces the risk. Always connect a specific defense to a specific attack.
- Thinking hashing is encryption — hashing is one-way and not meant to be reversed.
- Calling "password + security question" MFA — both are something you know (one factor).
- Believing a strong password alone stops credential stuffing — MFA is the real fix.
- Confusing authentication (who you are) with authorization (what you can do).
When a stem says "an attacker tried thousands of passwords automatically," that's brute force — the expected mitigation is account lockout + login attempt limits (and MFA). Match the attack named in the stem to the matching control in your answer.
09:02 user=jdeere FAILED (attempt 1)
09:02 user=jdeere FAILED (attempt 2) ... 09:03 attempt 41
09:03
ACCOUNT LOCKED after 5-attempt threshold — remaining tries ignored09:05 user=jdeere MFA challenge required on next login
Read it like AP wants: rapid repeated failures = a brute-force / dictionary attack; the ACCOUNT LOCKED after 5 attempts shows the lockout policy mitigating the threat by stopping further guesses; the MFA challenge adds a second factor.
Lab: Configure the Account Lockout Policy
The flagship lab. Tune the lockout settings, watch an attack simulation respond, then read the AP-style reasoning.
An account lockout policy disables a login after too many failed attempts, defeating automated guessing. Set the threshold below and run the simulated brute-force attack — see how many guesses the adversary gets before the door slams.
Password Attack Classifier
Read each fictional incident and tag the attack type. Instant feedback explains the giveaway.
Account Lockout Policy Configurator
Set the attempt limit and lockout duration, then run the simulated attack to see the policy in action.
Prompt: "An attacker is rapidly guessing the farm portal password. Recommend a configuration to mitigate this risk and explain how it works."
Model answer: The attack is brute force — many automated guesses. Configure an account lockout after 5 failed attempts with a 15-minute lockout, plus login attempt limits. This mitigates the risk because the attacker can no longer try unlimited passwords; after a few failures the account is disabled, so automated guessing becomes useless.
Layered defense: add MFA so even a correctly guessed password fails without the second factor, and enforce a password policy (length + complexity) so guesses are far less likely to succeed at all.
Misconceptions That Cost AP Points
Recognize the wrong answer and you'll avoid writing it.
× "Hashing and encryption are the same."
Encryption is reversible with a key; hashing is one-way and not meant to be reversed. Passwords are hashed, not encrypted.
AP trap: "stored so it can be decrypted later" describes the wrong approach for passwords.
× "A password plus a security question is MFA."
Both are something you know — that's one factor used twice, not multi-factor.
AP trap: MFA needs different factor types (know + have + are).
× "A long password makes lockout unnecessary."
Strong passwords slow guessing, but lockout/limits are still needed to stop automated brute force and protect reused passwords.
AP trap: defense is layered; one control rarely covers every attack.
× "Storing passwords is fine if the server is private."
Breaches happen. Plaintext storage means one leak exposes every password — hashing limits the damage.
AP trap: "kept on a secure server" doesn't justify plaintext.
× "Authentication and authorization mean the same thing."
Authentication proves who you are; authorization decides what you may access.
AP trap: watch the verb — "verify identity" = authentication.
× "Biometrics can never be defeated."
Biometrics are strong but not perfect (and can't be changed if compromised). Combine with another factor.
AP trap: no single factor is unbreakable — layer them.
Attack→Control Reference + Hardening Tools
A quick-reference table plus three hands-on tools: a factor matcher, a login hardener, and a password strength meter.
| Attack | How it works | Best Mitigation |
|---|---|---|
| Brute force | Tries every combination automatically. | Account lockout, attempt limits, MFA. |
| Dictionary | Tries common/likely passwords. | Strong password policy (length + complexity). |
| Credential stuffing | Reuses leaked credentials from other sites. | MFA, unique passwords, breach monitoring. |
| Rainbow table | Precomputed hash lookups reverse unsalted hashes. | Salt the hashes; use strong hash functions. |
| Phishing / keylogging | Captures the password directly from the user. | MFA, user training, anti-malware. |
Authentication Factor Matcher
Click an example, then click the factor bin it belongs to (know / have / are). Correct placements turn green.
Something You Know
Something You Have
Something You Are
Login Settings Hardener
Toggle each control on the AuthGuard panel. Your live security score reflects how hardened the device is.
Password Policy Strength Meter
Type a candidate password to test it against the farm's policy. (Use a fake password — never a real one.)
- At least 12 characters
- Contains an uppercase letter
- Contains a lowercase letter
- Contains a number
- Contains a symbol
- Not a common/dictionary password
Mini AP Quiz + Takeaways
Five quick AP-style questions with instant feedback, then your snapshot for review.
Mini AP-Style Quiz
Choose the best answer. Explanations appear instantly; your score totals at the end.
- 1Passwords are stored as one-way hashes (digests), so a stolen database doesn't reveal the actual passwords.
- 2Password attacks — brute force, dictionary, credential stuffing, rainbow tables, phishing — each have a matching mitigation.
- 3The three factors are something you know, have, and are; MFA combines two or more different types.
- 4Account lockout and login-attempt limits defeat automated guessing by cutting off repeated tries.
- 5A strong password policy plus MFA and hashing layers defenses — the AP Mitigate Risk skill in action.
To "mitigate risk" in an authentication answer, always pair the named attack with the named control and explain how it reduces risk — e.g., "brute force → account lockout → attacker can't keep guessing."
Practice — attempt these now.
AP-style assessments aligned to this lesson. Time them.