These classes of security products form a hierarchy which is set forth in Figure 1. Audit products are for monitoring and recording user activity. User Identification and Authentication products are for authenticating the identity of authorised users. The effectiveness of each succeeding class of security products is either dependent on or enhanced by the availability and effectiveness of one or more of the preceding classes. For example, without proper authentication of the identity of a user, it is difficult to control access to encryption keys or to effectively audit user activity.
Some analysts extend the hierarchy to show a further dependence on physical security.
All bets are off if the computer criminal wheels away the corporate database server in the middle of the night. Traditional authentication is any scheme based solely upon the first factor. Advanced authentication incorporates at least two factors. The most common method of user identification and authentication, something secret the user knows, is employed in static password systems. These systems require a user to input a secret word phrase or PIN selected by the user or chosen for the user by the system or application.