The purpose of security questions is to confirm the identity of a person trying to gain access to an account. This authentication protects organizations worldwide against cyber attacks.
Security questions are as secure as you make them. So, if you set up a weak security question system, hackers can quickly obtain the answers and breach the system. Understanding the different types of security questions, the best practices, how to make a good security question and alternative authentication methods to protect data can help secure the networks in your organization.
What is a Security Question?
Security questions are identity authentication methods involving what’s usually a confidential secret. Security questions are commonly used by financial institutions, wireless providers, cable companies and other security-minded organizations to provide an extra layer of protection.
These questions are sometimes called “password recovery questions” because they are often used to reset passwords on various accounts. The user will typically provide an answer to the security question when creating the account or signing up for an online service. Then, if the user forgets their password, the system will ask that they provide answers to the security question before granting access to retrieve or reset the password.
After entering the password, you can also use a security question as secondary identity verification. For instance, when the user logs in from an unknown location, the system will use the security question to confirm their identity.
Currently, there are sophisticated identification authentication methods such as USB security keys and biometric authentication, yet security questions remain helpful to serve as an optional or compulsory security layer. You can combine them with other authentication methods for enhanced security.
What Are the Common Types of Security Questions?
There are two main types of security questions:
- System-defined questions: These rely on the information within the service provider’s knowledge, including date of birth and address. The system holds sufficient information about the user, which is hard for the attacker to access. When deciding which information to feed the security question, consider whether the user will remember the answer, whether the hacker could effortlessly get that information and if the answers are easily guessable.
- User-defined questions: The user selects a question from a list, such as “What is your favorite color?” or “In what city was your first job?” and provides answers to them. The stronger the response the user provides, the more difficult it can be for the attacker to breach the system. Using user-defined security questions in conjunction with another method offers a robust solution.
How to Make a Good Security Question
Fundamentally, security questions and answers protect access to users’ information on an application or website. This protection can only be achieved if the security system is robust and the user can conveniently provide the relevant information to gain access. The question is, what is a good security question?
A good security question must be safe, memorable, stable, straightforward and capable of eliciting several possible answers. Let’s consider these in more detail:
1. Safe
Security questions help you protect valuable information, so you must ensure the answer is confidential.
The question you select and the answer you provide are both crucial. Provide a solution that’s not easily guessable. Some people offer fake answers, which is a creative and secure route if you can recall them after several months or years. Aim at making it difficult for attackers to breach the system by using questions that would generate unique, personal responses.
2. Memorable
Security questions offer secure solutions for retrieving and resetting passwords. The irony is that most people forget the answers they provide.
A good security question is one that the account holder can readily remember but is also not too obvious. Memorability ensures the user won’t have to write their answers down, which helps keep this authentication method safe.
3. Consistent
Your answers must be consistent — they shouldn’t change over time. The answer to a question like “What’s your favorite song?” will likely differ after several years, maybe even months. Instead of thinking about opinions and favorites, select questions with guaranteed, factual answers. The answer’s permanence makes it more stable and consistent.
4. Simple
A good security question should be simple and specific, ensuring users aren’t confused about what their answer could possibly be. These questions should also lead to simple responses, like a word or two, that are easy for users to remember.
5. Open-Ended
Good authentication questions should be open-ended in that they have multiple possible answers. Using questions with many probable answers reduces the risk of brute-force and automated attempts to hack an account. When the attackers try numerous times and fail, the service provider may lock the account until the problem is resolved.
Security Question Best Practices
Organizations, customers and employees must ensure their accounts are well-protected. This makes it essential to consider tried and tested procedures. The following tips should help you mitigate vulnerabilities:
1. Use Different Security Questions for Different Accounts
Hackers often target more than one account. So, if they successfully breach one security system, they might try to get hold of the others. Using different security questions on several platforms reduces your vulnerability.
If you have multiple social media and email accounts, select different questions on each platform, and encourage users in your organization to do the same. It’s best to choose a complicated question or one that is challenging to figure out, although you may provide simple, straightforward answers.
2. Renew the Security Questions Regularly
Periodically remind users to change their security questions and ensure they make the changes. Do this across the various accounts each user has access to. Renewing the questions from time to time makes you less predictable. Using the same security questions for a long time opens the doors for cyber attackers to hack into other accounts.
3. Avoid Using Self-Written Questions
The increase in compromised company records means your company’s security system should be unpredictable. Most people share vital information on social media platforms, making it easy for hackers to track, sleuth and dig out the answers, especially to questions users would write themselves. Generating questions for users is an efficient and secure way of using security questions.
4. Use Multiple Security Questions
The purpose of security questions is to protect your business against cyberattacks, so ask as many questions as possible and confirm the user’s identity before letting them in. Hackers may breach a single security question. However, asking multiple questions improves your security system.
You should also offer users a list of various security questions that cover a range of experiences when they set up their accounts. These options give users backup options if one question doesn’t apply to them, ensuring they answer a question they actually relate to and can remember the answer to.
5. Restrict the Answers
Users often adopt overly simple and predictable answers when given freedom. Although it’s best to use memorable and straightforward answers, ensure they are air-tight. Restrict the users from using guessable characters such as “1234” or “abcd”-type passwords. You can also limit the answer length and type or number of characters used.
Security Question Examples
There are good and bad security questions. While some check all the boxes, others fail to meet the minimum security standards. Using good questions can mitigate the risk of security breaches.
A good security question must elicit the correct answer from the users, although that may not be factually true. The answers the questions demand must be unpredictable, unique, simple and memorable. Let’s consider some examples of bad and good security questions.
Examples of Bad Security Questions
Examples of bad identity verification questions include:
- “What is your mother’s maiden name?”: The question is too common. Additionally, hackers can get answers with little research.
- “What is your date of birth?” or “when is your birthday?”: The answer to this question is easy to find, even on social media sites, such as Facebook, or national registries. Select a confidential inquiry. It makes it challenging for hackers to gain access to your records.
- “What is your favorite teacher’s name?”: A good security question must be memorable. The question is too distant, and users may forget the answers they provide. It’s better to restrict the security question to current topics fresh in mind or factual information that can’t change.
- “What’s your favorite color?”: Most people will answer “blue” to this question or select any of the standard colors like those in the rainbow. Such questions are predictable and make it simple for attackers to breach your security. Think like a hacker when framing the questions, and choose one that will take a massive effort to figure out.
- “What was your first car?”: The answer you provide to security questions must be clear and precise. This question may leave the user confused, and they may provide ambiguous responses. Users may be unsure whether to give the manufacturer’s name, model year or other information, which they may forget to include the next time the system asks them to provide an answer.
- “What is your favorite movie?”: A good security question must be stable. This question and many other “favorite” questions will likely change over time. Frame the query so the answer provided is guaranteed for years.
- “When is your wedding anniversary?”: This security question may not apply to specific groups of people, making it ineffective. The security question must apply to a broad demographic. This information could also be easily found on social media.
Examples of Good Security Questions
Examples of the best security questions for password reset and authentication include:
- “What was the first concert you attended?”: The answer to this question is likely to be uncommon, and only a few people can guess correctly. Additionally, users are unlikely to write the answer down because such events are memorable. The answer will remain constant forever.
- “What is the make and model of your first car?”: Users are likely to provide precise answers. This leaves no room for confusion. As a plus, people seldom forget the first car they drove.
- “In what city did your parents or guardians meet?”: The question demands a specific response from the user. Additionally, this security question is personal. It’ll take tremendous effort to find the answer.
- “What is your youngest sibling’s middle name?”: The question is personal, and only a handful of people may have access to that information. This makes your security system more secure. The same applies to other family members, such as your child or older sibling.
- “What city were you born in?”: A strong security question should provide uncommon answers. The location of a person’s birth is personal to that user and cannot change over time.
Alternative Authentication Methods
Other than establishing security questions, other authentication measures include:
- Multi-factor authentication (MFA): This authentication method requires two or more independent factors to identify the user, typically including the knowledge, possession and inherence factors. The knowledge factor uses what you know, such as your password. The possession factor uses something you have, like your smartphone, and the inherence factor relies on who you are by using your fingerprint or other features.
- Passwordless login: As the name suggests, passwordless logins take passwords out of the equation. This method allows users to gain access through biometrics — such as fingerprint and eye scanners or facial and voice recognition — or a magic link. Passwordless login eliminates the possibility of forgetting passwords and mitigates brute-force attacks.
- Strict password rules: The stronger the password, the more challenging it is for hackers to breach your security system. It’s helpful to use lengthy alphanumeric passwords combined with special characters. This way, it takes longer for brute-force programs to break in.
Keep Your Passwords Safe With the OptimalCloud
Cybersecurity is essential now more than ever. Information breach is a real threat to many businesses across the country, with nearly 109 million accounts breached in 2022’s third quarter. This makes it crucial to implement efficient and reliable security systems for added layers of protection.
The OptimalCloud is an advanced Identity and Access Management tool created for all corporations — small, mid-sized and multinational organizations alike — with complex network environments. It’s scalable, affordable and gives you access to the finest security tools used by the largest corporations in the United States. Using identity authentication tools such as MFA and Single Sign-on is the securest way to mitigate risks when connecting to applications and systems.
Partner With Optimal IdM for Your Security Solutions Today
The safest way to grow your business today amidst the increase in cybersecurity attacks is to secure identity authentication tools to verify each user when logging in or signing up for an application or website. Security questions are reliable security setups for retrieving passwords or as secondary identity verification tools. However, security questions are only as good as you make them.
Optimal IdM provides custom identity management solutions to help businesses improve and maintain consistent growth globally. We partner with organizations to provide comprehensive and efficient enterprise-level security solutions that meet the required standards. Contact us to learn more about how we can help!
