Security Measures Overview

Different checks protect against different threats

A security measure reduces the risk of unauthorised access or misuse. Some measures check who is requesting access; others make automated abuse harder or fix weaknesses in software. They serve different purposes, so a system may use several together.

Authentication means checking that a user is who they claim to be. A password checks something the user knows, while a biometric measure checks a characteristic of the person.

Password systems: checking a secret

A password system requires a user to enter a secret sequence of characters before gaining access. Usually, a username identifies the account and the password authenticates the person trying to use it.

The system checks the entered password against the credentials held for that account. If it matches, access is allowed; if it does not, access is refused. This helps prevent someone who knows an account's username, but not its password, from accessing it.

The protection depends on the password remaining secret and being difficult to guess. If an attacker obtains the correct password, the password check alone cannot distinguish the attacker from the genuine user.

Biometrics: checking a personal characteristic

A biometric measure uses a person's physical or behavioural characteristics to authenticate them. Examples include fingerprint scans, iris or retinal scans, facial recognition and voice recognition.

The system captures a characteristic and compares it with a previously registered biometric record. A sufficiently close match allows access; a failed match is rejected.

Biometrics are particularly useful on mobile devices. For example, a phone can compare a fingerprint placed on its sensor with the registered fingerprint before unlocking. This is convenient because the user does not need to type a password each time or remember the biometric characteristic.

Biometric characteristics are highly distinctive, making them useful for checking identity. However, biometric systems are not infallible: their security depends on how reliably they recognise the genuine user and reject other attempts.

CAPTCHA: checking for a human, not an identity

A CAPTCHA is a test designed to distinguish a human user from an automated program, or bot. Its name stands for Completely Automated Public Turing test to tell Computers and Humans Apart.

A text CAPTCHA may ask the user to read distorted characters and type them into a box. An image-based test may ask them to select all pictures containing vehicles. These tasks are designed to be easier for people than for automated programs.

For example, a website could require a CAPTCHA before allowing a comment to be posted. This makes it harder for a bot to submit large numbers of spam comments automatically. CAPTCHA can also help protect account registration, login attempts and ticket purchases from automated abuse.

Passing a CAPTCHA does not establish a person's identity or prove that their intentions are harmless. It checks for human involvement. Distorted text and image tests can also be difficult for legitimate users, particularly those with visual impairments, so accessible alternatives matter.

Email confirmation: checking access to an email account

Email confirmation checks that a user can access the email address they have supplied. A typical registration process works like this:

1. The user supplies an email address when creating an account.
2. The service sends a confirmation message containing a link or code to that address.
3. The user opens the message and follows the link or enters the code.
4. The service marks the email address as confirmed and allows access to the account or service.

Someone who enters an invented address, or another person's address without access to it, cannot complete this check. This helps prevent accounts being registered using email addresses the applicant does not control.

The important distinction is that email confirmation demonstrates access to the email account. It does not, by itself, prove someone's real-world name or identity.

Automatic updates: fixing software weaknesses promptly

A vulnerability is a weakness that an attacker could exploit. Vulnerabilities may be discovered after software has been released, so developers issue updates containing security fixes, often called patches.

Automatic software updates download and install updates without relying on the user to remember to check for them. They can be enabled in the operating system or individual applications, such as a browser or PDF reader.

Installing a security patch fixes the vulnerability it addresses. Applying it promptly reduces the time during which attackers can exploit that known weakness. Automatic updates therefore help protect devices from attacks targeting outdated software.

Updates do not replace authentication or guarantee protection from every threat. Together, these measures protect different parts of a system: they restrict access, reduce automated misuse and keep software weaknesses from remaining uncorrected.