ISC2 CISSP (Certified Information Systems Security Professional)Identity and Access Management (IAM)Medium
A security administrator is evaluating a new authentication system that uses cryptographic keys stored on a hardware token (e.g., a YubiKey) for user authentication. The system requires the user to insert the token and then touch it to complete the login process. Which authentication factor does the 'touching the token' action primarily represent?
- ASomething you have
- BSomething you are
- CSomething you do
- DSomething you know
Show answer & explanationAnswer & explanation
Correct answer: C. Something you do
The 'touching the token' action is a deliberate physical act performed by the user. This falls under the 'something you do' authentication factor, which represents a characteristic interaction or action unique to the user, distinct from simply possessing the token.
Why the other options are wrong
- A. The hardware token itself represents 'something you have', but the specific action of touching it is a different factor.
- B. Something you are refers to a biometric characteristic, like a fingerprint or retina scan, which is not what 'touching the token' represents.
- D. Something you know refers to a secret, like a password or PIN, which is not the primary factor represented by touching the token.
Authentication Factor - Something You Do
The 'something you do' authentication factor refers to unique actions or behaviors performed by a user, such as specific gestures, keystroke dynamics, or physical interactions.
- Represents unique user behavior.
- Often used in conjunction with other factors (e.g., possession).
- Examples: specific gestures, typing rhythm, touching a token.
Memory trick: KISS: Know, Inhere, Show, Sit, Step.