What it means
Authentication asks whether a claimant can present acceptable evidence for an identity. Traditional factor categories include something you know, such as a password; something you have, such as a security key; and something you are, such as a biometric characteristic. Location and behavior can inform risk decisions, but they are not always treated as independent primary factors.
How it works
Multifactor authentication requires evidence from more than one factor category. Two passwords are still one factor, and a password plus a knowledge question does not create true multifactor authentication. Strong systems also protect enrollment, recovery, device binding, session handling, and authenticator replacement.
A password combined with a FIDO security key uses knowledge and possession. A fingerprint that only unlocks a cryptographic key on a device may improve usability, while the underlying authenticator still relies on possession of the device-bound key.
Practical focus
- Choose phishing-resistant authenticators for high-risk access
- Protect recovery and enrollment as carefully as normal sign-in
- Require independent factors rather than two forms of the same evidence
- Match assurance to the sensitivity and consequences of the transaction
Common mistakes
- Counting two knowledge prompts as two factors
- Treating SMS delivery as equally strong in every threat environment
- Ignoring help-desk and account-recovery bypasses
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: