2 cissp ® Official Study Guide Eighth Edition

592
Chapter 13 
■
Managing Identity and Authentication
Cognitive Passwords 
Another password mechanism is the
cognitive password
. A cognitive password is a series of 
challenge questions about facts or predefi ned responses that only the subject should know. 
Authentication systems often collect the answers to these questions during the initial regis-
tration of the account, but they can be collected or modifi ed later. As an example, the sub-
ject might be asked three to fi ve questions such as these when creating an account: 
■
What is your birth date? 
■
What is your mother’s maiden name? 
■
What is the name of your first boss? 
■
What is the name of your first pet? 
■
What is your favorite sport?
Later, the system uses these questions for authentication. If the user answers all the 
questions correctly, the system authenticates the user. The most effective cognitive password 
systems collect answers for several questions, and ask a different set of questions each time 
they are used. Cognitive passwords often assist with password management using self-service 
password reset systems or assisted password reset systems. For example, if users forget their 
original password, they can ask for help. The password management system then challenges 
the user with one or more of these cognitive password questions, presumably known only by 
the user. 
One of the flaws associated with cognitive passwords is that the informa-
tion is often available via the internet. If a user includes some or all of the 
same information in an online profile, attackers may be able to use the 
information to change the user’s password. The best cognitive password 
systems allow users to create their own questions and answers. This 
makes the attacker’s job much more difficult.