input: [Vulnerabilities] Passwords and keys can be misappropriated in any of these ways: phishing and other email-based social engineering scams spyware infection acquired from any of a variety of web browsing exploits, such as cross-site scripting and pharming breaking weak passwords by brute force packet sniffing on insecure network traffic physical eavesdropping theft of keys and computers discarded computers and media Or authentication could be bypassed altogether, through: holes in application design or system configuration that provide an avenue for circumventing normal perimeter defenses Trojan "back door" planted by a virus or worm man-in-the-middle attacks and other variations of session hijacking [Countermeasures] education on common security threats and safe practices policies encouraging use of strong passwords with periodic expiration operating system lockdown, updates, and patch management malware scanning, blocking, and removal tools biometrics, smart cards, and two factor authentication technologies cryptographically secure storage and transmission of passwords, keys, and session state information strongly encrypted communications protocols, such as SSL and IPSec cryptographic hashing for secure password storage, session control, and proxy authentication multiple authentication, session timeouts, and logout functionality automatic lockout after repeated failed login attempts independent penetration testing preparing for rapid incident response [Element / Threat] 
output: Authentication ensuring legitimate identification of users and their agents Threat: An anonymous or bogus identity enters a restricted area, opening the door to further mischief.