4.2
Unit 4 · Securing Devices

Authentication

Authentication is how a device decides "are you really you?" In this lesson you sit at the security control panel and configure login settings that keep adversaries out.

Welcome to the AuthGuard Control Panel for AgriNova Farms. After last unit's device assessment, management wants every login locked down: the data server, the office laptops, the manager's phone app, and the IoT dashboards. Your task is to mitigate risk by choosing how users prove their identity and how the system reacts to attacks.

Authentication is the process of verifying that a user is who they claim to be. It is different from authorization (what you're allowed to do). Strong authentication rests on three pillars: safe password storage, resistance to password attacks, and multiple factors of proof.

Store Safely

Never store raw passwords. Use one-way hashes so a stolen database doesn't reveal anyone's password.

Prove Identity

Combine something you know, have, and are — multi-factor authentication beats a single password.

Harden Logins

Configure password policy, attempt limits, and account lockout to mitigate guessing attacks.

AP Learning Objectives
  • 1Explain why hashes are used to store passwords.
  • 2Explain how password attacks exploit vulnerabilities.
  • 3Determine the type of authentication used to verify the identity of a user.
  • 4Configure login settings to make a device more secure.
Scenario Setup — Configuring Authentication Settings

AgriNova's old system stored passwords in plaintext, allowed unlimited login attempts, and accepted weak passwords like farm123. You're handed the AuthGuard panel to fix it: turn on password hashing, set a password policy, enable multi-factor authentication, and configure account lockout after repeated failures — all on a safe, fictional system.

Big Idea

A password alone is a weak gate. Real security comes from storing secrets as hashes, requiring multiple factors, and configuring login settings that make automated guessing slow, noisy, and ultimately useless.

What You Will Learn

You'll explain why hashing protects stored passwords, classify password attacks, sort authentication into know/have/are, and configure lockout + policy settings that mitigate real risk — the AP Mitigate Risk skill.

Core Concept

Hashing, Password Attacks, and Factors

How passwords are stored, how attackers try to break them, and how layered factors stop them.

A hash function takes any input and produces a fixed-length output called a hash (also called a digest or, when used to verify integrity, a checksum). Hashing is one-way: you can compute the hash from a password, but you can't reverse the hash back into the password. That's exactly why systems store the hash of your password, not the password itself.

When you log in, the system hashes what you typed and compares it to the stored hash. If they match, you're in — and the real password was never kept on disk. So if the database is stolen, the adversary gets hashes, not usable passwords.

Password Storage Flow — the password is never saved User types "Tr@ctor!92" HASH FUNCTION one-way, fixed length DIGEST stored 9f86d0...4c2a DB stolen? attacker gets hashes, not pws Login check: hash what's typed, compare to stored digest. Same hash = correct password. One-way hashing keeps the plaintext password off the disk.
Figure 1 — Hashing means a breach exposes digests, not the actual passwords.

Adversaries still attack passwords. The most common password attacks:

  • Brute force: try every possible combination until one works.
  • Dictionary attack: try a list of common/likely passwords (password, farm123).
  • Credential stuffing: reuse username/password pairs leaked from other breaches.
  • Rainbow table: precomputed hash lookups to reverse unsalted hashes quickly.
  • Phishing / keylogging: trick or record the user to capture the password directly.

The three authentication factors defeat most of these by requiring more than one kind of proof:

Something You Know

Password, PIN, security question. Weakest alone — can be guessed or stolen.

Something You Have

Phone code, security key, smart card. The attacker needs the physical item.

Something You Are

Fingerprint, face, voice (biometrics). Tied to the person, hard to copy.

Why MFA Works Multi-factor authentication (MFA) combines two or more different factors. Stealing a password (something you know) is useless if the login also needs a phone code (something you have). Two passwords are not MFA — they're the same factor twice.
Lab 1

Hash vs Plaintext Password Storage Simulator

Type a password and watch how it would be stored two ways. Notice the same input always makes the same hash — but you can't read the password from it.

Plaintext storage (insecure)

If the database leaks, the adversary reads every password instantly.

Hashed storage (secure)

One-way digest. A leak exposes this, not the password. (Demo hash for learning only.)

Tip: change one character and the whole hash changes — that's the avalanche effect.
Key Vocabulary

Terms for MCQ and Device Security Analysis

Precise definitions you'll need for multiple choice and free-response answers.

Authentication Vocabulary
TermDefinitionControl-Panel Example
AuthenticationVerifying a user is who they claim to be.Logging in to the AuthGuard panel.
Hash / digestFixed-length, one-way output of a hash function.Stored instead of the raw password.
ChecksumA hash used to verify data hasn't changed (integrity).Confirms a firmware file wasn't tampered with.
SaltRandom data added before hashing so identical passwords hash differently.Defeats rainbow tables.
Brute force attackTrying every possible password combination.Blocked by lockout + limits.
Dictionary attackTrying lists of common/likely passwords.Blocked by strong password policy.
Credential stuffingReusing leaked username/password pairs.Blocked by MFA + unique passwords.
Multi-factor authentication (MFA)Requiring two or more different factor types.Password + phone code.
Account lockoutDisabling login after repeated failures.Lock after 5 failed attempts.
Password policyRules for password length, complexity, and reuse.12+ chars, mixed types required.
The Three Authentication Factors
FactorWhat it isExamples
Something you knowInformation only the user should have.Password, PIN, security question.
Something you haveA physical item the user possesses.Phone authenticator code, security key, smart card.
Something you areA physical/behavioral trait (biometric).Fingerprint, face scan, voice.
hash / digest checksum salt brute force dictionary credential stuffing MFA account lockout password policy
AP Exam Focus

What the Exam Wants You to Explain

Skill in focus: Mitigate Risk — choose and configure controls that reduce the chance or impact of an attack.

AP Skill Alignment — Mitigate Risk

For authentication, a complete AP answer: (1) names the threat (e.g., brute-force guessing), (2) names the control that mitigates it (e.g., account lockout + MFA), and (3) explains how the control reduces the risk. Always connect a specific defense to a specific attack.

Common MCQ Traps
  • Thinking hashing is encryption — hashing is one-way and not meant to be reversed.
  • Calling "password + security question" MFA — both are something you know (one factor).
  • Believing a strong password alone stops credential stuffing — MFA is the real fix.
  • Confusing authentication (who you are) with authorization (what you can do).
Scenario Connection

When a stem says "an attacker tried thousands of passwords automatically," that's brute force — the expected mitigation is account lockout + login attempt limits (and MFA). Match the attack named in the stem to the matching control in your answer.

Analyst Note — Evidence Artifact
[AUTH LOG] farm-portal — AuthGuard (fictional)
09:02 user=jdeere FAILED (attempt 1)
09:02 user=jdeere FAILED (attempt 2) ... 09:03 attempt 41
09:03 ACCOUNT LOCKED after 5-attempt threshold — remaining tries ignored
09:05 user=jdeere MFA challenge required on next login

Read it like AP wants: rapid repeated failures = a brute-force / dictionary attack; the ACCOUNT LOCKED after 5 attempts shows the lockout policy mitigating the threat by stopping further guesses; the MFA challenge adds a second factor.

Authentication Factor Model — combine types for MFA KNOW password, PIN HAVE phone, key ARE fingerprint, face MFA = 2+ DIFFERENT factor types One factor = weak · Two different factors = strong
Figure 2 — MFA pulls from two or more different circles; two passwords stay in one circle.
Worked Example

Lab: Configure the Account Lockout Policy

The flagship lab. Tune the lockout settings, watch an attack simulation respond, then read the AP-style reasoning.

An account lockout policy disables a login after too many failed attempts, defeating automated guessing. Set the threshold below and run the simulated brute-force attack — see how many guesses the adversary gets before the door slams.

Lab 2

Password Attack Classifier

Read each fictional incident and tag the attack type. Instant feedback explains the giveaway.

Classified: 0 / 4
Lockout Policy Effect — guesses allowed before the door locks No lockout unlimited guesses — attacker eventually wins Lock at 10 10 tries, then locked Lock at 3 3 tries, then locked — brute force stalls Lower threshold = fewer guesses for the attacker (balance against locking out real users).
Figure 3 — Tighter lockout thresholds shrink the attacker's window; too tight frustrates legitimate users.
Lab 3

Account Lockout Policy Configurator

Set the attempt limit and lockout duration, then run the simulated attack to see the policy in action.

Failed attempts before lockout lower = stricter
Lockout duration how long the account stays locked
Require MFA after lockout adds a second factor
AP-Style Reasoning Walkthrough

Prompt: "An attacker is rapidly guessing the farm portal password. Recommend a configuration to mitigate this risk and explain how it works."

Model answer: The attack is brute force — many automated guesses. Configure an account lockout after 5 failed attempts with a 15-minute lockout, plus login attempt limits. This mitigates the risk because the attacker can no longer try unlimited passwords; after a few failures the account is disabled, so automated guessing becomes useless.

Layered defense: add MFA so even a correctly guessed password fails without the second factor, and enforce a password policy (length + complexity) so guesses are far less likely to succeed at all.

Common Mistakes

Misconceptions That Cost AP Points

Recognize the wrong answer and you'll avoid writing it.

× "Hashing and encryption are the same."

Encryption is reversible with a key; hashing is one-way and not meant to be reversed. Passwords are hashed, not encrypted.

AP trap: "stored so it can be decrypted later" describes the wrong approach for passwords.

× "A password plus a security question is MFA."

Both are something you know — that's one factor used twice, not multi-factor.

AP trap: MFA needs different factor types (know + have + are).

× "A long password makes lockout unnecessary."

Strong passwords slow guessing, but lockout/limits are still needed to stop automated brute force and protect reused passwords.

AP trap: defense is layered; one control rarely covers every attack.

× "Storing passwords is fine if the server is private."

Breaches happen. Plaintext storage means one leak exposes every password — hashing limits the damage.

AP trap: "kept on a secure server" doesn't justify plaintext.

× "Authentication and authorization mean the same thing."

Authentication proves who you are; authorization decides what you may access.

AP trap: watch the verb — "verify identity" = authentication.

× "Biometrics can never be defeated."

Biometrics are strong but not perfect (and can't be changed if compromised). Combine with another factor.

AP trap: no single factor is unbreakable — layer them.

Reference & Practice Tools

Attack→Control Reference + Hardening Tools

A quick-reference table plus three hands-on tools: a factor matcher, a login hardener, and a password strength meter.

Password Attack → How It Works → Mitigation
AttackHow it worksBest Mitigation
Brute forceTries every combination automatically.Account lockout, attempt limits, MFA.
DictionaryTries common/likely passwords.Strong password policy (length + complexity).
Credential stuffingReuses leaked credentials from other sites.MFA, unique passwords, breach monitoring.
Rainbow tablePrecomputed hash lookups reverse unsalted hashes.Salt the hashes; use strong hash functions.
Phishing / keyloggingCaptures the password directly from the user.MFA, user training, anti-malware.
Lab 4

Authentication Factor Matcher

Click an example, then click the factor bin it belongs to (know / have / are). Correct placements turn green.

Something You Know
Something You Have
Something You Are
Placed: 0 / 6
Lab 5

Login Settings Hardener

Toggle each control on the AuthGuard panel. Your live security score reflects how hardened the device is.

Store passwords as hashes not plaintext
Enforce strong password policy length + complexity
Enable multi-factor authentication 2+ factor types
Account lockout after failed attempts stops brute force
Limit & log login attempts detect attacks
0
Wide open — turn on controls to harden the device.
Lab 6

Password Policy Strength Meter

Type a candidate password to test it against the farm's policy. (Use a fake password — never a real one.)

Strength: —
  • At least 12 characters
  • Contains an uppercase letter
  • Contains a lowercase letter
  • Contains a number
  • Contains a symbol
  • Not a common/dictionary password
Practice & Wrap-Up

Mini AP Quiz + Takeaways

Five quick AP-style questions with instant feedback, then your snapshot for review.

Lab 7

Mini AP-Style Quiz

Choose the best answer. Explanations appear instantly; your score totals at the end.

5 Key Takeaways
  • 1Passwords are stored as one-way hashes (digests), so a stolen database doesn't reveal the actual passwords.
  • 2Password attacks — brute force, dictionary, credential stuffing, rainbow tables, phishing — each have a matching mitigation.
  • 3The three factors are something you know, have, and are; MFA combines two or more different types.
  • 4Account lockout and login-attempt limits defeat automated guessing by cutting off repeated tries.
  • 5A strong password policy plus MFA and hashing layers defenses — the AP Mitigate Risk skill in action.
hash / digest checksum salt something you know something you have something you are brute force dictionary MFA account lockout password policy
Final AP Exam Tip

To "mitigate risk" in an authentication answer, always pair the named attack with the named control and explain how it reduces risk — e.g., "brute force → account lockout → attacker can't keep guessing."

One Mistake to Avoid Don't call two of the same factor "multi-factor." A password and a security question are both something you know — real MFA mixes different factor types.
09
Section · 09

Practice — attempt these now.

AP-style assessments aligned to this lesson. Time them.

Topic Quiz 40 min 30 marks Pending

Unit 4 Topic 4.2 — Authentication

AP-style topic practice assessment

Start
FRQ Practice 20 min 9 marks Pending

Unit 4 Topic 4.2 — Authentication Settings Analysis

AP-style topic practice assessment

Start