4 Authentication and Basic Security Controls
Learn how authentication factors and everyday security controls help protect accounts, devices, and data, and how to use them effectively.
methods
checks whether a person or device is allowed to access an account or system. factors fall into three broad categories:
Something you know: a password or PIN.
Something you have: a phone, authenticator app, or physical security key.
Something you are: a biometric, such as a fingerprint or face scan.
combines two or more different factor types. For example, a password and an authenticator-app code combine something you know with something you have. Using two passwords alone does not provide two different factors.
MFA adds protection if a password is stolen, but it is not a complete defense: codes typed into a website can still be tricked by phishing. When available, prefer such as passkeys or security keys.
Protect account credentials
Use a different password for every account. If a password stolen from one site is reused elsewhere, an attacker can try it on other services.
Choose long, hard-to-guess passwords or passphrases. A can create and store unique passwords. Protect the manager with a strong master password and MFA where available. Current NIST digital identity guidance sets a 15-character minimum for passwords used as a single factor.
Never share passwords or MFA codes, and do not approve an unexpected login prompt. Instead of following a suspicious message link, go to the service using its known app or address.
If you suspect a password has been exposed, change it on that service and anywhere it was reused. Review account recovery options and sign out of unfamiliar sessions.
For example, if a shopping-site password is exposed, unique passwords prevent an attacker from using it to try to enter your email account. MFA on the email account adds another barrier.
Keep software updated
Install operating-system, application, browser, and device firmware updates promptly. Updates often fix security weaknesses that attackers could exploit. Turn on automatic updates when practical, and restart devices when required so the updates take effect.
Use firewalls
A filters network traffic according to security rules. Keep the built-in on for computers and phones, and use the in a home router.
Do not disable a just to make an unfamiliar app work. Use trusted support to check the specific setting instead. A can reduce unwanted network connections, but it does not replace updates, malware protection, or careful handling of links and files.
Maintain recoverable backups
Back up important files regularly to a separate location, such as an external drive or a trusted cloud service. Keep at least one disconnected or otherwise protected from the device being backed up, because malware such as may try to damage accessible backups.
Test that you can restore files. A is useful only if recovery works.
Combine security controls
Use unique, lengthy passwords and a , and enable MFA, favoring when available. Keep software updated, leave firewalls enabled, and maintain tested backups, ideally including a copy separated from the device.
These controls work together, but none is a complete defense on its own.