Authentication Methods: Basic vs. NTLM

Introduction

• Types of authentication are discussed
• Basic authentication is covered
• An overview of NTLM protocol is given
• Advanced authentication techniques are listed

Types of Authentication: Basic Authentication

• This authentication method stands as the simplest and most direct
• Users gain system or service access by providing a username and password
• It does not require additional infrastructure, or complex setups
• It is widely supported across HTTP, FTP, and APIs
• Every request includes credentials making it stateless
• The server does not need to track the session

Basic Authentication

• Simple setup and operation are the major advantage, making it easy to use
• Works effectively with most HTTP clients and APIs
• The stateless nature reduces server-side complexity
• It lacks security and is vulnerable to interception over unencrypted channels
• Credentials are valid indefinitely unless revoked making no expiry
• Multi-factor authentication is not inherently supported
• Attackers can reuse intercepted credentials unless protected by HTTPS replay attacks

Types of Authentication: NTLM protocol - 1

• NTLM, or New Technology LAN Manager, is a Microsoft security protocol suite providing user authentication, integrity, and confidentiality
• It is commonly found in legacy systems but is increasingly replaced by Kerberos in modern setups
• Primarily operated in Windows environments to authenticate users and computers using a challenge/response mechanism
• The authentication mechanism consists of three messages: negotiation, challenge from the server, and authentication message from the client

Types of Authentication: NTLM protocol - 2

• NTLM comes with limitations
• The method relies on a single authentication meaning a challenge-response protocol to establish the user
• Security vulnerabilities exist because its password hashing can make NTLM systems vulnerable to attacks
• The outdated cryptography does not use the latest advances in encryption to make passwords more secure

NTLM protocol Adv/Disadv

• Passwords are not sent over the network in plaintext form, offering better security
• It offers compatibility with older Windows systems and legacy applications
• Windows-integrated authentication makes using it automatically easier
• The vulnerabilities and doesn't authenticate the server to the client
• NTLM performance is less efficient than modern authentication protocols

Advance Authentication Techniques

• Microsoft recommends passwordless methods to provide a secure sign-in experience
• Users can still sign in using common methods such as username and password
• Passwords should be replaced with more secure authentication methods
• Multifactor authentication adds another layer of security over password use alone
• Credential Guard, Kerberos authentication, MFA, Certificate-Based Authentication, Pass-Through Authentication, OAuth and OpenID Connect are advanced authentication examples

Credential Guard

• A Microsoft Windows OS security feature that isolates user login information from the rest of the OS
• It is designed to prevent common credential theft attacks
• Credential Guard was introduced in Windows 10 Enterprise and Windows Server 2016
• It's enabled by default on all systems running Windows 1, version 22H2 and later
• It uses hardware-backed, virtualization-based security (VBS) along with a Local Security Authority (LSA) to reliably store "secrets" e.g. credentials
• The containers it uses are isolated, and OS cannot access them

Credential Guard - 1

• Local Group Policy Editor is one way of enabling the feature

Credential Guard - 3

• Window + R executes msinfo32.exe
• System Information -> System Summary contains the details of its configuration

Kerberos Authentication - 1

• It acts as a gateway between users and the internet
• It helps prevent cyber attackers from entering a private network
• It authenticates users while preventing passwords from being sent online
• It is integrated into popular operating systems
• It is the default authorization technology in Microsoft Window

Kerberos Authentication - 2

• Symmetric key cryptography and a key distribution center (KDC) are used to authenticate and verify user identities
• The KDC involves three items: a ticket-granting server (TGS), a database, and an authentication server (AS)
• During authentication, Kerberos stores the ticket for each session on the end-user's device
• A Kerberos-aware service looks for this ticket

Kerberos Authentication - 3

• Components include a client, the initiating service requester on the user's behalf
• Includes the server, hosting the service to which the user needs access
• AS performs client authentication and if successful provides a ticket-granting ticket (TGT) or user authentication token
• The components also include KDC consisting of AS, TGS, and the Kerberos database
• A TGS application issues service tickets

Kerberos Authentication - 4

• Single point for keeping track of all logins and the enforcement of security policies, giving admins Access control
• Allows service systems and users to authenticate each other = mutual authentication
• The lifetime data is controlled by admins for each ticket
• Reusable authentication allows continued user authentication throughout the ticket's lifetime with reentering personal information
• Security: passwords are not sent over networks, and secret keys are encrypted
• It has a single point of failure
• Hosts date and time configurations need to be synchronized with predefined limits

Multi-Factor Authentication - 1

• The security mechanism requires two or more verification factors for system access
• MFA can be implemented via Azure Active Directory, Windows Hello for Business, or third-party tools
• Steps include the user enters their username and password
• The user is prompted for a second factor like mobile app notification, OTP or biometrics
• When the second factor is validated you are granted access

Multi-Factor Authentication - 2

• There are different methods in Windows
• A mobile app (Microsoft Authenticator App) generates OTPs/approves sign-ins
• Hardware tokens like FIDO2 security keys (e.g., YubiKey) or smart cards.
• Biometric authentication using Windows Hello, supports facial recognition, fingerprint, or PIN
• One-time codes sent via text messages or emails
• Push Notifications (prompts sent to a registered device for approval)

Multi-Factor Authentication - 3

• Enhanced security, is an advantage, it reduces reliance and mitigates risks from phishing and bruteforce attacks
• Offers multiple methods (biometrics, hardware keys) to accommodate different user needs making it user flexible
• Meets regulatory requirements and easily integrates with Azure AD and other Microsoft services
• There is user resistance which can be met with training, in addition device availability and lost second-factor devices can be addressed with backup codes

Certificate-Based Authentication - 1

• Authentication is achieved via digital certificates for users, devices, or services
• Trusted Certificate Authorities (CA) verify identity without relying on username or password combinations in Windows Environments
• The process: A trusted CA issues the digital certificate with a public key, then client presents it to the server during authentication
• Finally, the server checks validity, expiration date, and revocation status

Certificate-Based Authentication - 2

• Certificates are used in user authentication by replacing passwords with smart cards
• Devices are verified when accessing corporate resources via VPN or Wi-Fi
• Web Server Authentication uses client certificates to securely access to web applications or services
• Email Encryption uses certificates with S/MIME to enable secure email communication

Certificate-Based Authentication - 3

• Certificates are resistant to password-related attacks offering a high level of security
• Secure communication is achieved between client and server
• Using PKI and Group Policy for large-scale deployments enhances scalability
• Compliance to regulatory requirements is achieved more easily through this
• Automated tools ease Certificate management for issuance, renewal, and revocation
• Virtual smart cards can reduces hardware reliance, and device dependency
• Update CRLs (Certificate Revocation Lists) regularly

OAuth and OpenID Connect - 1

• They are modern authentication and protocols
• User grants limited access to their computer resources on one system to another without sharing credentials with Oauth 2.0
• Key components include the following: Resource Owner, Client, Authorization Server, and Resource Server

OAuth and OpenID Connect - 2

• The client requests authorization from the resource owner
• The resource owner grants authorization, typically via a browser-based flow
• The client exchanges the authorization code for an access token, and the token accesses protected resources

OAuth and OpenID Connect - 3

• OIDC extends OAuth 2.0 by adding an identity layer
• Clients can verify the identity of the end-user and obtain basic profile information via ID Tokens
• A JWT (JSON Web Token) contains user identity information
• Standard Scopes: includes openid, profile, and email for fetching user details
• Authentication Context: Adds login-related information, such as time of authentication and authentication methods

OAuth and OpenID Connect - 4

• The client sends an authorization request, including the openid scope
• The authorization server authenticates the user.
• An ID token and an access token are issued
• The client uses the ID token to verify user identity and the access token for resource access

OAuth and OpenID Connect - 5

• OAuth 2.0 for token-based API authentication used to secure APIs
• Single Sign-On is enabled with OIDC for seamless authentication
• On-premises Active Directory is bridged with Azure AD
• Third-Party App Integration allows secure access to services using OAuth/OIDC

OAuth and OpenID Connect - 6

• Security eliminates credential sharing across applications, therefore more secure
• Scales easily on-premises & in the cloud
• Enables Single Sign-On for seamless user access, making a better user expirience
• Widely adopted across platforms = Standardization
• Managing tokens, token revocation and complexity with integration can be a challenge

Explore the characteristics, vulnerabilities, and differences between basic and NTLM authentication methods. Understand the security concerns associated with each and when NTLM authentication is appropriate. Learn why migrating from NTLM to modern protocols is crucial for enhanced security.