Question

Authentication policy uses password that contains at least one uppercase, ercase, number and special character with the length of minimum 5 all risk treatment alternatives plan to the above policy, with at least providing ample to each alternative. (2 Points)

Answer 1

The traditional password policy having certain length of the password phrase containing an Uppercase letter along with some lowercase letters, special characters and numbers have certain limitations as they provide security to only a certain level but when we are living in such a vulnerable environment involving high level of security threats, we need other layers of security too.

There are certain factors which can be kept in mind while designing layers of authentication to a system such as Login Pattern of the user, Geolocation of the logins, IP address of logged in machines or Geovelocity. In case of any discrepancy one must ensure to enable other layers of protection in order to keep their data/system safe.

There are many ways to ensure better protection of the systems such as :

1. Using OTP(One Time Passwords) - This involves sending OTP to your mobile number or email id to provide a 2-factor authentication.

2. Using Biometrics options - Using Touch ID to login also ensures authenticity as only designated user can access it.

3. Push Notifications - One must need to approve the push notification received on the user smartphone in order to access the concerned system.

4. Smartcards - Having a personalised smartcard to access also provides a secure layer of authentication.

Also we can use TOTP i.e. Time-based OTP in which the OTP is valid only for a certain length of time ensuring a better and niche approach in secured authentication process.