Cyber Security Notes — Modules 4
CYBER SECURITY NOTES
Study Notes — Modules 4
Beginner Phase
Module 4 — Passwords, Authentication & Access Control
Page 1
Cyber Security Notes — Modules 4
MODULE 4 — Passwords, Authentication & Access Control
Sessions 41–48 | Duration: 12 hours | Phase: Beginner
4.1 Password Strength, Entropy & Common Mistakes
Password strength is measured by how difficult a password is to guess or crack — technically expressed as
entropy, the number of possible combinations an attacker would need to try.
What Is Entropy?
Entropy (in bits) is calculated roughly as: length × log2(character set size). A larger character set and greater
length both increase entropy exponentially.
Password Example Length Character Set Approx. Entropy Crack-Time
Estimate*
password123 11 lowercase + digits ~40 bits Instant – minutes
P@ssw0rd! 9 upper+lower+digit+symbol ~59 bits Minutes – hours
Tr0ub4dor&3xplor3 17 upper+lower+digit+symbol ~100+ bits Centuries
correct-horse-battery-staple 29 lowercase words + ~80–100 bits Centuries
hyphens
*Estimates vary with attacker hardware; the table shows relative order of magnitude, not exact figures.
Common Mistakes
• Reusing the same password across multiple accounts (one breach compromises all of them).
• Using predictable substitutions only (e.g., 'P@ssword1') — attackers' dictionaries already include these
patterns.
• Including personal information (birthdays, pet names, own username) that can be guessed or found via
social media.
• Choosing short passwords even when a system technically allows longer ones.
Best-practice guideline:
Prefer a long passphrase (4+ random unrelated words, 16+ characters) over a short complex password —
length contributes more to entropy than complexity alone, and passphrases are easier to remember.
4.2 Multi-Factor Authentication (MFA)
MFA requires two or more independent forms of proof ('factors') before granting access, so a stolen password
alone is not enough to breach an account.
Factor Type Description Example
Something you know A secret only you should know Password, PIN, security question
Something you have A physical or digital item you Phone (OTP app/SMS code),
possess hardware security key, smart card
Page 15
Cyber Security Notes — Modules 4
Factor Type Description Example
Something you are A biological trait unique to you Fingerprint, face scan, voice pattern
Typical MFA Login Flow
25. User enters username and password (Factor 1: something you know).
26. System sends/generates a one-time code (Factor 2: something you have) via an authenticator app, SMS, or
hardware key.
27. User enters the code within a short validity window (usually 30–60 seconds for app-based codes).
28. Access is granted only if both factors are verified successfully.
Security note:
Authenticator apps (e.g., TOTP-based apps) are generally more secure than SMS codes, since SMS can be
intercepted through SIM-swapping attacks.
4.3 Password Managers
A password manager securely stores and auto-fills unique, complex passwords for every account, protected
behind one strong master password (and ideally MFA).
Why Use One?
• Removes the need to memorise dozens of passwords — enables a unique password per site without reuse.
• Generates long, random, high-entropy passwords automatically.
• Many managers flag reused, weak, or breached passwords automatically.
• Encrypts the password vault locally/in the cloud, typically using strong encryption (e.g., AES -256).
Setting Up a Password Manager — General Workflow (Demo Account)
29. Choose a reputable password manager (built into the browser/OS, or a dedicated app).
30. Create a master password that is long, unique, and not reused anywhere else.
31. Enable MFA on the password manager account itself — this is the single most important account to
protect.
32. Import or manually add existing account credentials into the vault.
33. Use the built-in password generator to replace weak/reused passwords with strong, unique ones.
Important:
The master password must never be stored anywhere else (written down insecurely, saved in a plain text file,
or reused) — it is the single key protecting every other credential.
4.4 Biometrics: Pros and Cons
Biometrics authenticate a person using unique physical or behavioural traits — fingerprint, facial recognition, iris
scan, or voice pattern.
Page 16
Cyber Security Notes — Modules 4
Advantages Disadvantages
Convenient — nothing to remember or type Cannot be changed if compromised (unlike a
password, you cannot 'reset' your fingerprint)
Difficult to share or forget (unlike a password) Can potentially be spoofed (e.g., high-resolution
photos fooling weak facial recognition)
Fast authentication — often under one second Raises privacy concerns over biometric data storage
and misuse
Hard to guess remotely (unlike a password) Requires specific hardware (fingerprint sensor,
camera) to function
Best practice:
Biometrics work best as one factor within MFA (something you are), combined with a password or PIN — not
as the sole method of protecting highly sensitive accounts.
4.5 Hands-On Labs & Activities — Module 4
🧪 Hands-On Lab Activities
• Password-Strength Testing: Use an offline/local password-strength estimation tool to compare the
entropy of different password styles from Section 4.1.
• Set up a free password manager using a demo account, generate several strong passwords, and
organise a small credential vault.
• Enable MFA on a demo or personal account using an authenticator app, and observe the full login flow
described in Section 4.2.
• Module 4 recap activity and quiz covering passwords, MFA, password managers, and biometrics.
Module 4 — Key Takeaways
• Password strength depends on entropy — length and unpredictability matter more than complexity alone.
• MFA combines something you know, something you have, and/or something you are, so a leaked
password is not enough to compromise an account.
• Password managers make unique, high-entropy passwords practical across dozens of accounts — protect
the master password above all else.
• Biometrics are convenient but irreversible if compromised, and work best as one factor in a layered
authentication strategy.
Page 17