The effectiveness of each succeeding class of security products is either dependent on or enhanced by the availability and effectiveness of one or more of the preceding classes. For example, without proper authentication of the identity of a user, it is difficult to control access to encryption keys or to effectively audit user activity. Some analysts extend the hierarchy to show a further dependence on physical security. All bets are off if the computer criminal wheels away the corporate database server in the middle of the night. Traditional authentication is any scheme based solely upon the first factor.
Advanced authentication incorporates at least two factors.
The most common method of user identification and authentication, something secret the user knows, is employed in static password systems. These systems require a user to input a secret word phrase or PIN selected by the user or chosen for the user by the system or application. Most operating system suppliers provide static password security. However, static passwords are often shared between users and can be guessed, stolen or observed. As a result, they can be compromised without user awareness.