CYBER SECURITY
Detailed Topic-Wise Study Notes
Module 4 — Passwords, Authentication & Access Control | Beginner Phase | Sessions 41–48 (12 hours)
Topic 4.1 — Password Strength, Entropy & Common Mistakes
Password strength is measured by how difficult a password is to guess or crack — technically expressed as
entropy, the number of possible combinations an attacker would need to try before finding the correct one.
What Is Entropy?
Entropy (in bits) is calculated roughly as: length × log2(character set size). Both a larger character set and greater
length increase entropy — and each additional character multiplies the number of possible combinations, so
entropy grows exponentially rather than in a straight line.
Password Example Length Character Set Approx. Crack-Time
Entropy Estimate*
password123 11 lowercase + digits ~40 bits Instant –
minutes
P@ssw0rd! 9 upper+lower+digit+symbol ~59 bits Minutes – hours
Tr0ub4dor&3xplor3 17 upper+lower+digit+symbol ~100+ bits Centuries
correct-horse-battery-staple 29 lowercase words + hyphens ~80–100 bits Centuries
*Estimates vary with attacker hardware; the table shows relative order of magnitude, not exact figures.
Common Mistakes
• Reusing the same password across multiple accounts — one breach compromises all of them (a technique
attackers exploit called 'credential stuffing').
• Using predictable substitutions only (e.g., 'P@ssword1') — attackers' dictionaries already include these
exact patterns.
• Including personal information (birthdays, pet names, own username) that can be guessed or found via
social media.
• Choosing short passwords even when a system technically allows longer ones.
Best-Practice Guideline
Prefer a long passphrase (4+ random unrelated words, 16+ characters) over a short complex password
— length contributes more to entropy than complexity alone, and passphrases are easier to remember.
Topic 4.2 — Multi-Factor Authentication (MFA)
MFA requires two or more independent forms of proof ('factors') before granting access, so a stolen password
alone is not enough to breach an account.
The Three Factor Types
Factor Type Description Example
Something you know A secret only you should know Password, PIN, security question
Something you have A physical or digital item you possess Phone (OTP app/SMS code), hardware
security key, smart card
Something you are A biological trait unique to you Fingerprint, face scan, voice pattern
Typical MFA Login Flow
1. User enters username and password (Factor 1: something you know).
2. System sends/generates a one-time code (Factor 2: something you have) via an authenticator app, SMS, or
hardware key.
3. User enters the code within a short validity window (usually 30–60 seconds for app-based codes).
4. Access is granted only if both factors are verified successfully.
Security Note
Authenticator apps (TOTP-based) are generally more secure than SMS codes, since SMS can be
intercepted through SIM-swapping attacks — where an attacker convinces a mobile carrier to transfer
the victim's phone number to a new SIM card.
Topic 4.3 — Password Managers
A password manager securely stores and auto-fills unique, complex passwords for every account, protected
behind one strong master password (and ideally MFA).
Why Use One?
• Removes the need to memorise dozens of passwords — enables a unique password per site without reuse.
• Generates long, random, high-entropy passwords automatically.
• Many managers flag reused, weak, or breached passwords automatically.
• Encrypts the password vault locally/in the cloud, typically using strong encryption (e.g., AES-256).
Setting Up a Password Manager — General Workflow (Demo Account)
5. Choose a reputable password manager (built into the browser/OS, or a dedicated app).
6. Create a master password that is long, unique, and not reused anywhere else.
7. Enable MFA on the password manager account itself — this is the single most important account to protect.
8. Import or manually add existing account credentials into the vault.
9. Use the built-in password generator to replace weak/reused passwords with strong, unique ones.
Important
The master password must never be stored anywhere else — not written down insecurely, not saved in a
plain text file, and never reused. It is the single key protecting every other credential in the vault.
Topic 4.4 — Biometrics: Pros and Cons
Biometrics authenticate a person using unique physical or behavioural traits — fingerprint, facial recognition, iris
scan, or voice pattern.
Advantages Disadvantages
Convenient — nothing to remember or type Cannot be changed if compromised (unlike a
password, you cannot 'reset' your fingerprint)
Difficult to share or forget (unlike a password) Can potentially be spoofed (e.g., high-resolution
photos fooling weak facial recognition)
Fast authentication — often under one second Raises privacy concerns over biometric data storage
and misuse
Hard to guess remotely (unlike a password) Requires specific hardware (fingerprint sensor,
camera) to function
Best Practice
Biometrics work best as one factor within MFA (something you are), combined with a password or PIN
— not as the sole method of protecting highly sensitive accounts.
Topic 4.5 — Hands-On Labs & Activities
Password-Strength Testing
Use an offline/local password-strength estimation tool to compare the entropy of different password styles from
Section 4.1.
Password Manager Setup
Set up a free password manager using a demo account, generate several strong passwords, and organise a small
credential vault.
MFA Enablement
Enable MFA on a demo or personal account using an authenticator app, and observe the full login flow described
in Section 4.2.
Module Recap & Quiz
Module 4 recap activity and quiz covering passwords, MFA, password managers, and biometrics.
Module 4 — Key Takeaways
• Password strength depends on entropy — length and unpredictability matter more than complexity alone.
• MFA combines something you know, something you have, and/or something you are, so a leaked password
is not enough to compromise an account.
• Password managers make unique, high-entropy passwords practical across dozens of accounts — protect the
master password above all else.
• Biometrics are convenient but irreversible if compromised, and work best as one factor in a layered
authentication strategy.