FIDO Risk Assessment & Mitigation 3

Question 1

A security architect rates an authenticator that stores keys in a Trusted Execution Environment (TEE) versus one using software-only storage. What risk difference is most significant?

Accepted Answer

Software-only key storage is more vulnerable to OS-level malware extracting the private key

Answer

Software-stored keys can be extracted by privileged malware, while TEE hardware isolation prevents key extraction even from a compromised OS.

Question 2

Which scenario represents a supply chain risk specific to FIDO hardware authenticators?

Accepted Answer

An attacker distributes counterfeit authenticators with backdoored firmware pre-installed

Answer

Counterfeit or tampered authenticators could undermine FIDO's security guarantees before they reach end users.

Question 3

In FIDO threat modeling, what is the primary purpose of the 'clientDataHash' included in the authenticator assertion?

Accepted Answer

To cryptographically bind the assertion to the specific client and origin, preventing replay

Answer

The clientDataHash ties the signature to the challenge and origin, ensuring assertions cannot be replayed in a different context.

Question 4

An organization assesses risk of a FIDO authenticator being used after an employee is terminated. Which mitigation is most appropriate?

Accepted Answer

Deleting the user's credential record at the relying party to invalidate the authenticator

Answer

Removing the server-side credential entry means the authenticator's public key is no longer trusted, blocking future authentications even if the device is retained.

Question 5

Which risk does biometric spoofing (presentation attack) target in a FIDO authenticator, and what mitigates it?

Accepted Answer

It targets the user verification step; mitigated by Presentation Attack Detection (PAD) in the sensor

Answer

PAD (liveness detection) in the biometric sensor rejects fake fingerprints or face replicas, protecting the user verification step.

(FIDO) FIDO Certified Authenticator Practice Test

(FIDO) FIDO Certified Authenticator Practice Test

FIDO Risk Assessment & Mitigation 3