Karka
All courses

Free course

Authentication, MFA and Access Security

Hold, protect and prove your identity at work: strong credentials, phishing-resistant factors and safe recovery.

What this course does not do

This course covers your own accounts and everyday authentication decisions. It does not authorise you to grant, approve or administer privileged access; those permissions are assigned separately and carry their own approval process.

Company mandatoryBeginnerSOC 2
6 modules 33 lessons 3 enrolled ~1.5h of material
Start learning — freeAlready a member? Sign in

First three lessons free. Full access with Founding Annual Access, ₹3,999 for your first year.

Authentication, MFA and Access Security

By the end

What you'll build

  • Create and store credentials in a way that survives a breach-list or credential-stuffing attempt
  • Choose the strongest multi-factor method available for a given account and explain the trade-off
  • Recognise and refuse push-fatigue, real-time relay and one-time-code interception attempts
  • Enrol, back up and recover your own authentication factors without creating a new weakness
  • Apply session, sign-out and device practices that limit the damage of a lost or stolen device

Curriculum

What's inside

6 modules · 33 lessons

  1. 01

    What Authentication Actually Proves

    5 lessons
    • Identification, Authentication and Authorisation: Three Different Questions
    • Factors: Something You Know, Have and Are
    • Why a Password Alone Stopped Being Enough
    • Accounts, Identities and Roles: Which One Is Being Checked
    • Claim, Proof and Permissionmatch pairs
  2. 02

    Credentials That Hold Up

    5 lessons
    • Building a Passphrase You Can Remember and an Attacker Cannot Guess
    • Reuse, Breach Lists and Credential Stuffing
    • Using a Password Manager Safely, Including Its Own Master Secret
    • Secrets That Are Not Passwords: Keys, Tokens and Recovery Codes
    • Credentials That Hold Upfill blank
  3. 03

    Multi-Factor Methods Compared

    6 lessons
    • Ranking the Methods: One-Time Codes, Push, Passkeys and Hardware Keys
    • One-Time Codes and Their Weak Points
    • What "Phishing-Resistant" Actually Means
    • Text Messages, SIM Swapping and Number Porting
    • Biometrics: What They Protect and What They Do Not
    • + 1 more lesson
  4. 04

    Attacks Aimed at Your Second Factor

    6 lessons
    • Push Fatigue and the Approval You Should Never Give
    • Real-Time Relay and Adversary-in-the-Middle Sign-In Pages
    • Help-Desk Impersonation and Reset Fraud
    • Session Token Theft After a Successful Login
    • Consent Prompts and Over-Permissioned Connected Apps
    • + 1 more lesson
  5. 05

    Enrolment, Recovery and Everyday Hygiene

    6 lessons
    • Setting Up a Second Factor With a Working Way Back In
    • Backup Codes: Generating, Storing and Retiring Them
    • Changing Phones Without Losing Access
    • Reporting a Lost Factor Before Someone Else Uses It
    • Signing Out, Session Limits and Shared Devices
    • + 1 more lesson
  6. 06

    Practice and check

    5 lessons
    • Factors, Attacks and What They Actually Meanmatch pairs
    • Enrolling a Second Factor Without Locking Yourself Outsequence order
    • Say It Preciselyfill blank
    • Three Prompts at Midnightscenario
    • Course quizquiz

The shape of it

How this course works

Short lessons

33 lessons across 6 modules, each small enough to finish in one sitting.

Practice as you go

Every lesson ends with a small space for what you noticed — the doing is the learning.

Progress you can see

Your progress is saved lesson by lesson, ready whenever you come back.

Ready when you are.

Make an account and this course opens up — your progress is saved from the very first lesson.

Start learning — freeSign in