Security Questions: Still In Use but No Longer Acceptable?
- JULY 15TH, 2024
- 1min read
Introduction
Security questions are a common form of identity authentication commonly used when creating accounts or signing up for services online, where users confidentially share answers to secret questions with providers.
Security questions are no longer recognized by NIST SP 800-63 as a valid authentication method due to security concerns but remain widely used for password recovery and additional security layers. This necessitates careful selection of security questions to avoid associated risks.
Desired Characteristics of Security Questions
- Memorable: The user must recall the answer years after account creation.
- Consistent: The answer must not change over time.
- Applicable: The user must be able to answer the question.
- Confidential: The answer must be hard for attackers to obtain.
- Specific: The answer should be clear to the user.
Avoiding Bad Security Questions
- Predictability: Avoid questions with small answer pools (e.g., “What is your favourite colour?”).
- Discoverability: Avoid questions with answers easily found online (e.g., “What is your nickname?” or “What is your best friend’s name?”). Attackers use polls/question threads to gather such data.
- Forgeability: Easily forgettable questions diminish reliability. A good question must be consistent.
- Repetition: Avoid reusing security questions across multiple accounts.
Explore more CIL Advisories
Phishing Emails
IntroductionPhishing attacks are becoming increasingly sophisticated, with malicious actors exploiting current events like the Paris 2024 Olympics Games to run…
DECEMBER 16TH, 2024
Read More
Preventing Deep Fake Scams
IntroductionMalicious actors always find creative ways to defraud unsuspecting individuals; deep fake scams are one of the latest ways with…
DECEMBER 9TH, 2024
Read More
Trouble Looms: Ransomware Attacks on the Rise
IntroductionRansomware is a type of malware which prevents you from accessing your device and the data stored on it, usually…
DECEMBER 2ND, 2024
Read MoreNever miss a CIL Security Advisory
Stay informed with the latest security updates and insights from CIL.
