ESSENTIAL 6 Access Control Access can be given based on what one knows, what one has, or who one is. Access to accounts or networks can be controlled with measures like passwords, token devices and fingerprints. Multifactor authentication involves granting access based on two or more of the mentioned categories. As passwords can be broken by a skilled attacker, this single factor is no longer enough to protect your accounts. Extra authentication by digital tokens or biometrics makes it harder for unauthorised users to break into accounts. Individuals with privileged access must use multifactor authentication, especially when accessing the IT network or system outside the workplace. This defence also limits an attacker's access to multiple IT systems or data. Even if the attacker gets hold of a user ID and password, these extra levels of authentication work like extra locks that he has to break to gain entry.