Week 2: Authentication and Password Defense

Last week you defined what security is trying to protect. This week you focus on one of the most common access-control questions:

How does a system decide that you are really you?

Garden State Cyber I introduces authentication through passwords, tokens, multi-factor authentication, biometrics, password attacks, hashes, salts, and the trade-offs behind different login methods.

This week

Lesson 1: Authentication: Prove Who You Are

Separate identification, authentication, and authorization. Compare authentication factors and analyze weaknesses such as password reuse, shared accounts, weak recovery, and missing accountability.

Lesson 2: Passwords, Hashes, and Salt

Use fictional samples to see why secure systems should not store readable passwords, why identical passwords should not automatically create identical stored values, and why hashing does not solve every credential problem.

Lesson 3: Which Authentication Method Fits the Risk?

Design authentication for a fictional school system. Choose factors, recovery, logging, account lifecycle, and authorization roles, then threat-test the design.

What you will produce

• authentication-event analysis
• safe sample-only hash/salt observations
• password-storage comparison
• authentication decision tree
• final Authentication Architecture

Safety rule

Never submit a real password to a classroom tool, worksheet, public checker, screenshot, or demo. Use only teacher-provided or invented sample strings.

By the end of the week, you should be able to explain not only whether a login method is strong, but what failure it is designed to resist and where its recovery path can still break.