Exercise 3: Why Knowledge-Based Checks Only Prove Knowledge, Not Identity — Possible Solution ==================================================================== WHAT A KNOWLEDGE-BASED CHECK ACTUALLY TESTS ------------------------------ An employee ID, a date of birth, or a "mother's maiden name" question tests one thing only: whether the person answering knows a specific piece of information. It cannot, by itself, distinguish between "the real employee, who obviously knows this" and "anyone else who happens to also know this fact." WHY THAT DISTINCTION MATTERS ------------------------------ Per this chapter, this kind of information is "often guessable, previously leaked in an unrelated breach, or simply findable through the pretexting techniques Chapter 3 covered." None of those three paths require being the actual employee - a data breach unrelated to this organization can expose a birthdate, a pretexting call (Chapter 3) can extract an employee ID directly from an unsuspecting coworker, and some answers (a common surname) are guessable outright. An attacker who has done reconnaissance can pass a knowledge-based check with zero connection to the real identity being impersonated. WHY THIS IS A DIFFERENT KIND OF WEAKNESS THAN "THE ANSWER MIGHT BE WRONG" ------------------------------ The problem isn't that a legitimate employee might fail the check by mistake - it's the opposite: an illegitimate requester can pass it correctly, because knowing the fact was never actually tied exclusively to being that person in the first place. A check that a non-employee can pass isn't a weak identity check - it's not really an identity check at all, just a knowledge check that happens to overlap with identity most of the time. WHY THE CHAPTER STILL ALLOWS IT AS ONE LAYER, NOT ZERO VALUE ------------------------------ The chapter doesn't say these questions are worthless - it says they "should never be the only check standing in front of a high-risk [request]." Combined with an independently-verified callback, a weak layer still adds some friction; alone, it verifies nothing meaningful against a prepared attacker. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains what the check actually measures (knowledge, not identity), lists the specific ways this chapter says that knowledge can be obtained without being the real person, and explains why a check that a non-employee can pass isn't real verification on its own.