Evaluate password and multi-factor authentication controls.
Explain identity federation and trust configuration.
Plan recovery without weakening the primary control.
Authentication factors include knowledge, possession, and inherence. MFA reduces password-only risk, but recovery channels, phishing, push fatigue, and session theft remain important. Federation lets one identity provider issue assertions or tokens accepted by relying services under an explicit trust relationship.
identity provider -> authenticated assertion -> relying party
relying party -> validate issuer, audience, expiry, signature -> session
Password policy should favor long unique passwords, breached-password screening, slow hashing, rate limits, and password managers. Federation validation must check issuer, audience, signature, expiry, nonce or state, and intended redirect.
Exercises
Compare TOTP, security keys, and push MFA against phishing.
List claims a relying party must validate.
Design a lost-device recovery flow.
Self-check
What is federation?
Why is recovery security-critical?
What does audience validation prevent?
Self-Check Quiz
1. Does MFA eliminate phishing?
AnswerNo. It raises the bar; phishing-resistant security keys and careful recovery reduce risk more effectively than weak approval prompts.
2. Why validate an assertion's audience?
AnswerTo ensure the assertion was intended for this relying service rather than another service.
Homework
Design enterprise login with federation and MFA.
Document token validation and session creation.
Threat-model account recovery.
Sample answerValidate issuer, signature, audience, expiry, nonce/state, and required claims before creating a limited session. Recovery should require independent verified factors, notify the user, expire temporary access, and create an audit trail.