knowledge-based authentication

Knowledge-based authentication (KBA) is an authentication scheme in which the user is asked to answer at least one "secret" question. KBA is often used as a component in multifactor authentication (MFA) and for self-service password retrieval.

Secret questions can be static or dynamic. In a static scheme, the end user pre-selects the questions he would like to be asked and provides the correct answers. The question/answer pairs are stored by the host and used later to verify the end user's identity. In a dynamic scheme, the end user has no idea what question will be asked. Instead, the question/answer pairs are determined by harvesting data in public records.

KBA questions can be factual, like "What city were you born in?" or "What color Ford Mustang was registered to you in New York State in 2002?" or they can be about preferences, like "What is your favorite food?" or "Who was your favorite teacher?" Both static and dynamic schemes rely on the assumption that if someone knows the correct answers to the secret questions, their identity has been confirmed.

Learn more

Josh Levin explores the problems that KBA poses for end users in the article "In What City Did You Honeymoon?"

Expert Joel Dubin answers the question "Are knowledge-based authentication systems doing more harm than good?"

Learn more about Web Authentication and Access Control

	Identity and Access Management Services, Systems and Technologies: This Security School explores critical topics related to helping security practitioners establish and maintain an effective identity and access management plan.
Information Security Decisions Session Downloads: Session Downloads from Information Security Decisions 2006 Conference.
How to build an identity and access management architecture: Learn the essentials of identity and access management, from the role of directories to effectively establishing approval workflows.
Controlling Web access with Apache: How to meet access control requirements with Apache and IIS Web servers.
RSA 2005 conference coverage: Can't make it to RSA? Let us take you there. We're covering the conference live from the show floor to bring you the latest information security news.
Lesson/Domain 2 -- Security School: Training for CISSP Certification: SearchSecurity.com Security School webcasts are focused on CISSP training. Each lesson corresponds to a specific domain in the CISSP exam's "Common Body of Knowledge."

Do you have something to add to this definition? Let us know. Send your comments to techterms@whatis.com

FILE EXTENSION AND FILE FORMAT LIST File Extension and File Format List: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z #

RELATED CONTENT Group to shed light on secure identity management threats Identity management technologies are struggling to keep pace with constantly evolving nature of attacks, according to the Center for Applied Identity... IT business justification to limit network access Are you hoping to limit network access at your organization, but aren't sure how to go about creating an IT business justification for a proxy server?... How to confirm the receipt of an email with security protocols Many websites try to ensure secure registrations by sending email confirmations. But how is it possible to confirm receipt of that email by the...

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary access log  (SearchSecurity.com) anonymous Web surfing  (SearchSecurity.com)