Multifactor authentication, password concepts and privileged access

Objective 4.6 in this course covers identity and access management. The previous lesson took provisioning, SSO and the access control models; this one takes multifactor authentication, password concepts and privileged access tools from CompTIA's scope note. It is the applied lab for 4.6.

Why this matters

MFA is the single highest-value control in this exam. It appeared as the answer to four separate attacks in Domain 2 — spraying, stuffing, offline cracking and pass-the-hash — and it is the control that makes a stolen password insufficient.

Password guidance is the area where the exam has moved and where a lot of older study material has not. Forced complexity and 90-day expiry are no longer current guidance, and the exam reflects that. Answering from habit will cost marks here.

The lesson

Something you know, have, are, and somewhere you are

The factors, and the rule that makes MFA work:

• Something you know — password, PIN, security question.
• Something you have — phone, hardware token, smart card, security key, certificate.
• Something you are — biometric: fingerprint, face, iris, voice.
• Somewhere you are — location, from IP geolocation, GPS or network.
• Something you do — behavioural: typing rhythm, gait, usage pattern.

Multifactor means factors from different categories. A password plus a security question is not MFA — both are things you know, and both are obtainable from the same breach or the same phishing page. The exam tests this directly, so read the options for the category rather than the count.

The reasoning behind the rule: each category fails differently. Knowledge is phished and guessed and reused. Possession is stolen and lost. Inherence is hard to change once compromised. Requiring two categories means one attack technique is not enough.

Biometrics, hard and soft tokens, security keys, SMS and its weakness

Biometrics are convenient and have properties worth knowing:

• False acceptance rate (FAR) — wrongly accepting an impostor. The security failure.
• False rejection rate (FRR) — wrongly rejecting the legitimate user. The usability failure.
• Crossover error rate (CER) — where the two are equal, used to compare systems: lower is better.
• Sensitivity can be tuned, and it trades one error rate against the other — tightening to reduce FAR raises FRR.
• The irrevocability problem: a compromised password is changed, a compromised fingerprint is not. Good implementations store a template locally in a secure enclave and never transmit the biometric itself.

Tokens and keys, roughly in ascending order of strength:

• SMS one-time codes — better than nothing and the weakest option. Defeated by SIM swapping, by interception, and by simply asking the user for the code (the vishing scenario from Domain 2). If a question asks for the weakest MFA method, this is it.
• Soft tokens / authenticator apps — TOTP codes generated on the device. No SIM to swap, works offline, and still phishable, because the user can be induced to type the code into a fake site.
• Push notifications — approve on the phone. Convenient and vulnerable to MFA fatigue, where repeated prompts eventually get approved to stop the noise. Number matching — the user must type a number shown on the login screen — is the mitigation, because it requires the user to be looking at the real login.
• Hard tokens — dedicated hardware producing codes.
• Security keys (FIDO2/WebAuthn) — the strongest, and the reason is structural: the key performs a cryptographic challenge bound to the origin of the site requesting it. A phishing site has a different origin, so the key will not respond. This makes it phishing-resistant, which no code-based method is. If a scenario asks how to stop credential phishing outright, the answer is FIDO2 security keys or certificate-based authentication.

Password length, complexity, reuse, expiration and age, stated as current guidance

CompTIA examines the modern position, which reversed several long-standing practices. The reversals happened because the old rules produced predictable passwords.

• Length is the dominant factor. Long passphrases beat short complex strings, and the guidance is a high minimum length with a generous maximum.
• Complexity requirements — one upper, one digit, one symbol — produce Password1! and its variants. Current guidance de-emphasises forced composition in favour of length plus a screening list.
• Reuse is the real enemy, because credential stuffing from Domain 2 depends on it entirely. Prevent reuse across systems with a password manager and SSO, and screen new passwords against known-breached password lists.
• Expiration — routine forced expiry is no longer recommended without cause. It drives predictable incrementing (Summer2026! → Autumn2026!) and increases help desk load without improving security. Force a change on evidence of compromise, which is where breached-password screening and monitoring earn their place.
• Age — a minimum age exists to stop users cycling straight back to their old password after a forced change.

Two supporting controls:

• Password managers — generate long unique passwords per site and remove the reuse problem. They concentrate risk in one vault, which is why the vault needs a strong master credential and MFA; on balance the trade is strongly favourable and the exam treats it as the recommended answer.
• Passwordless — removing the password entirely in favour of a security key, certificate, or device-bound biometric. Nothing to phish, guess, reuse or crack. This is the direction of travel and it appears in the exam as the strongest option where it is offered.

Account lockout policy belongs here too: it stops brute force and — as the password attacks lesson established — does nothing about spraying, which is detected in aggregate instead.

Just-in-time permissions, password vaulting and ephemeral credentials

Privileged access management (PAM) addresses the accounts that matter most: domain administrators, root, cloud administrators, service accounts and break-glass identities.

The tools CompTIA names:

• Just-in-time (JIT) permissions — an administrator holds no standing privilege. They request elevation when needed, it is approved and time-boxed, and it expires automatically. The security value is that there is no permanent privileged account to steal: an attacker compromising the person's everyday identity gets an ordinary user. This is standing privilege reduced to zero, and it is the single most valuable idea in this section.
• Password vaulting — privileged credentials are held in a vault. Users check them out, use them, and check them back in, at which point the password is rotated automatically. Often the credential is never revealed at all, because the vault injects it into the session. Every use is attributable to a named person even when the underlying account is shared.
• Ephemeral credentials — credentials that exist only for one session and then cease to be valid. Certificates minted for an hour, cloud tokens with a short lifetime, one-time passwords. There is nothing durable to steal, and they are the cloud-native version of the same idea.

Supporting practices: separate administrative accounts so that privileged work is never done from the account that reads email; privileged session recording for audit; approval workflows for high-impact actions; and break-glass accounts — emergency identities with full privilege, stored offline, monitored aggressively, and alerted on every single use.

The reasoning to carry into the exam: the standard attack path is compromise a user, escalate, move laterally as an administrator. JIT and ephemeral credentials attack the middle of that chain by ensuring there is rarely a privileged credential in existence to capture.

What to take into the exam

• Multifactor requires different categories. Password plus security question is single factor.
• SMS is the weakest common second factor — SIM swapping and vishing defeat it.
• FIDO2 security keys are phishing-resistant because the response is bound to the site's origin; codes and push are not.
• Number matching is the mitigation for MFA fatigue.
• Current guidance: length over complexity, screen against breached lists, and no routine forced expiry — change on evidence of compromise.
• JIT elevation means there is no standing privileged credential to steal; vaulting rotates on check-in and makes shared accounts attributable.