Methods to detect and prevent cyber security threats: password systems

The idea

Password systems authenticate a user by checking something the user knows against a stored record. A strong password is long and mixes character types, and it should not be a dictionary word or personal detail. Systems store passwords as a hash rather than plain text, often with a salt, so a stolen database does not reveal the passwords directly. Good practice includes limiting login attempts, locking accounts after repeated failures and requiring a change when compromise is suspected. Weaknesses remain: users reuse passwords, choose guessable ones, or fall for phishing that captures them. Passwords are often combined with another factor, such as a code sent to a phone, to form multi-factor authentication.

What earns the marks

• Identifies a password system as authentication using something the user knows, checked against a stored record.
• Explains that passwords should be stored as a hash, often salted, rather than in plain text.
• States a strength: passwords are familiar, cheap to deploy and can be changed if compromised.
• States a limitation: passwords can be guessed, reused across sites, phished or stolen in a data breach.
• Recognises measures that strengthen password systems, such as limiting login attempts, account lockout and multi-factor authentication.

Common mistakes and how to put them right

• Saying passwords are stored in plain text.

  Put it right by explaining that a hash, often with a salt, is stored instead.

• Believing a long password alone is always strong.

  Put it right by noting that predictable phrases and reused passwords remain weak.

• Confusing a password with a biometric.

  Put it right by stating that a password is something the user knows, not a physical characteristic.

Exam tips

• Check whether the question asks about how a password system works, a strength or a weakness, and select accordingly.
• Eliminate options describing something the user is or has, because those are not password systems.
• Prefer options that mention hashing, salting or limiting attempts when the question is about protecting stored passwords.