Authentication Methods

Authentication

• Authentication verifies an entity's claimed identity.
• "Identity" must be relevant to the "verifier".
  • It can be a globally unique identifier (a real-world identity).
  • It may be a local identifier established through enrolment.
• To validate their claim, the claimant has to provide authentication factors.

Authentication of Users

• Whenever users exercise their privileges, they must prove to the system the identity they claim.
• The system must guarantee that attackers cannot masquerade as legitimate users by manipulating identifiers.
• Users need assurance the system prevents masquerade attacks.
• The system needs to ensure users are communicating with authorized systems and that attackers are not responsible for actions performed.
• The system must ensure the user's persona cannot later be used to impersonate them.

Authentication Factors

• Main authentication factors: something the user knows, has, or is.

Something the User Knows

• Knowledge-based authentication:
  • Password
  • PIN
  • Pass Phrase
  • Personal data
  • Word Association

Password/PIN

• Knowledge-based authentication.
  • Cheap
  • Easily revoked
  • User acceptance is typically high.
  • Provides a high level of security.

Graphical Password

• Users interact with images rather than text.

Password/PIN Disadvantages

• Knowledge-based authentication
  • User accountability issues
  • Privilege is not controlled by the user once assigned
  • The user may be unaware of compromise
  • Demands remembering details
  • Susceptible to eavesdropping and illicit capture
  • Risk of capture by a masquerading system
  • Possible password leaks to untrustworthy entities

Password/PIN Alternatives

• One-Time Passwords
  • The user proves secret knowledge or access to secret knowledge
  • User responses differ with each login attempt
  • Eavesdropped or captured passwords can't be reused
  • Techniques involve device access under "Something the user has"

Textual Password Cracking

• Two methods for cracking textual passwords:
  • Brute force (trying all combinations)
  • Dictionary attacks (using common/likely passwords)

Password Cracking

• The process involves determining the hash function and possible salt.
• Requires deciding attempt to use
• Dictionary attacks are often enough for cracking "any account".
• Trying all possible combinations may be needed for "particular account" cracking.
• Locating and acquiring cracking resources is necessary.

Graphical Password cracking

• Involves pattern analysis on graphical unlock patterns
• Brute force attack [389,112 possible patterns]
• Pattern bias [start points and end points]
• Smudge attack [oily residue]

Something the User Has

• Authentication based on physical ownership:
  • Magnetic stripe card
  • One-shot password token
  • Smart cards

Magnetic Stripe Cards

• One-shot password tokens:
  • Synchronized password generators
  • Challenge-response systems
• Smart cards:
  • Stored data cards securely store data, preventing unauthorized copying or modification.
  • Cards have processing capability with an embedded computer chip and data storage.
• Magnetic Stripe Card:
  • Used widely in banking systems.
  • Contain identification information that includes special printing/holograms.
  • Include written signatures and customer data recorded on a magnetic stripe.
  • Easy to counterfeit by copying data from one card to another.
  • Universally accepted and cheap to produce, but with limited security and functionality.

One-Shot Password Tokens

• Synchronized password generators produce series of random passwords on both a token and host system.
  • Tokens include a clock.
  • Also feature an alphanumeric sequence generator.
• Challenge-response tokens are also part of the Something a user has category.

Challenge Response Systems

• Protocol wherein one party issues a challenge and the other provides a valid response.
• User and system share a secret key

Summary: Something the User Has

• Advantages:
  • Attackers require physical possession of the token.
  • Users cannot share tokens with each other.
  • Tokens can be combined with other methods, such as one-time passwords.
  • Users are aware if a token is lost.
  • The user must report token loss.
  • Illegal possession of a token is evidence of wrongdoing.
• Disadvantages:
  • Cost of the token and checking mechanism

Administration of Tokens

• Distribution
• Recording
• Lost token reporting
• Replacement of expired tokens
• Destruction

Something the User Is

• Biometrics use automated methods to verify/recognize someone based on characteristics.
• Methods are either physical or behavioral.

Basic Processes

• Analog capture of the user's attribute
• Development of a template of the user’s attribute via enrolment
• Template comparison against a stored value when access is requested.
• Decision on whether to grant access, based on the comparison.

Biometric Classification

• Physiological: body measurements include fingerprint, face, iris, and retina recognition.
• Behavioral: voice, signature recognition, keystroke/touch dynamics are measured.

Biometrics

• Proves or disproves identity by fingerprint recognition.

Biometric Types

• Authentication or Identification is determined by:
  • Voice recognition attempts to characterize a person's voice signature.
  • Signature recognition measures activities like signing on paper or digitizing tablets.
  • Gait analysis identifies individuals by the way they walk using accelerometers.
  • Behavior profiling aims to identify unique patterns of mobile service use
  • Keystroke dynamics utilize rhythm when typing on a keyboard.
  • Touch dynamics captures factors like touch duration via touchscreens.

Multi Factor Authentication

• Combining 2-3 authentication factors increases confidence that systems are accessed by authorized users.

Two-Factor Authentication

• Combines physical device and personal secret, like PIN or password, to enhance security.

Access Control

• A collection of mechanisms working to create a security architecture of an information system.
• A goal of access control is personal accountability, showing who performed a computer activity.

Authorisation

• This process determines if a principal's access request for an object should be granted.
• A reference monitor is the entity that enforces policy
• Access Control Lists (ACL) defines the policy.
• Setting the policy in the ACL is known as authorization.
• Process finds correct rules for a given access request.

Accountability

• Establishes the capability to trace actions uniquely to an entity, supporting key security goals.
• Nonrepudiation, deterrence, fault isolation, intrusion detection/prevention, recovery, and legal action are supported.
• Launched processes after events occur, such as regular/technical audits and incident-triggered investigations.

Information Owner

• Has overall responsibility for data within an information system.
• Decides who uses the system and system recovery.

Controlling Access

• Two main methods:
  • Physical access control: uses locks, guards, and badges to control entry to physical areas.
  • Logical access control: Relies on validated identity through PINs, cards and biometrics related to information and knowledge.

Access Control Goals

• Prevent attackers from gaining physical orlogical access to a system.

Primary Security Concerns

• CIA Triad:

Confidentiality

• Protect data, including privacy and proprietary information from unauthorized access.

Integrity

• Maintain accuracy, completeness, consistency, and validity of an organization's data.

Availability

• Ensure business data for org., partners and end-users is available when required.

Access Control Procedures

• Allocation of privileges: Limit the type of access granted.
• Administration of privileges: Recording and revocation of privileges.
• The need to monitor accesses and prevent unauthorized access.
• Identification and authentication of users.

Allocation of Privileges and mandatory access control

• Centrally controlled by a policy administrator for all users.
• The system decides who can access information based on the relationship between :
  • Subjects: People/systems granted clearance.
  • Objects: system elements being protected.
  • Labels: mechanisms binding object to subjects.
• Mandatory Access Control: the security clearance levels the subject's labeled security are guaranteed for all users.
• All users have a security clearance and all files have a security classification.
• System uses rules for user access to resources.

Discretionary Access Control (DAC)

• Information owner grants privileges, giving subjects control over access.
• OS systems rely on DAC principles for access and operations.

Access Control Lists

• A list of users granted access to a system and what access they have.
• Privileges are typically: Read, Write, Update, Delete or Rename.

The Least Privilege (Need-to-Know)

• Assurance of confidentiality is achieved by giving users only what is needed.
• Authority to perform a transaction or access a resource is based on need.

Role-Based Access Control (RBAC)

• Controls access by assigning users to groups with specific rights.
• Suited for environments with high employee turnover and movements
• Avoids any one users holding too much control

Administration of Privileges

• Procedures are used to hand over, inform users, record privileges, and revoke privileges.

Handing over Privileges

• Identification of the recipient needed, alongside legitimacy / Is he/she who they claim to be
• Security is paramount / risk of secret leaks - such as passwords

Informing Users

• Inform users of use conditions, such as:
  • Access limitations.
  • Disclosure restrictions.
  • Handling unauthorized requests.
  • Disciplinary consequences for violations.
  • Actions during security incidents, Reporting procedures.

Recording Privileges

• Mechanisms needed to record user access details, such as:
  • How access is recorded.
  • Associating access with users.
  • Identifying users with access to specific resources.
  • Securing records against disclosure.

Revoking Privileges

• Mechanisms needed for privilege revocation without user cooperation.
  • The need to notify relevant parties about the withdrawal.
  • Processes for users to return privileges.
  • User verification of privilege withdrawal is needed
• Physical access is harder to revoke than logical access.

Digital Rights Management (DRM)

• From the entertainment sector to control games, videos, and music ("content").
• Prevents content producers and distributors from facing losses because of copying of digital content
• Controls how content is accessed/used on customer devices.
• DRM places a third-party security policy onto the system owner rather than protecting it.

Roots of Trust

• Requires high tamper resistance.
• Trusted platform modules (TPMs) offer hardware assurance.
• Trusted execution environments (TEEs) use software enclaves, such as Intel SGX.
• Attestation enables trustworthy platform setup information.
  • Direct Anonymous Attestation protects user privacy.
• Remote attestation supports software security policies running remotely.

Monitoring Accesses

• Defends against access control loopholes Provides evidence of security incidents.
• Models normal behavior.

System Monitoring & Threats

Why monitor?

• Legitimate users may bypass access control.
• Protection against attackers is needed
• Authentication could be vulnerable
• Users granted limited authorization may abuse it

Security Practices

• To collect security event evidence model normal behaviors
• It also can provide feedback on previous successful and unsucessfull logins.
• Password Expermentation and logins detected when its not a use.

Aspects of Logs Levels.

• High level logs may fail, because if defects in software this could fail.
• Low Level logging will impact performace massive amount of audit dat.

Accountability.

• Provides what events will be logged
• Hackers could hide traces if aquired.
• Tamper Resistance: Log rely on phsycial means.
• Privacy can impede results of whats to be logged.

Data levels.

• Filing System is Clear Text
• Dedicated Authentication Server Clear Text
• Password + Encryption
• Hasging
• Has using a username and password

Adding Data.

• Instead use "Store of Password"
• Verify password to make sure its store in an actual file

Password Security

• Algorithm better than trial and erro.
• Hard to find (Hpassword) some string.

Salting

• Use a rando piece of data and has this before the String.
• Use the has different times.
• Store the Data that will be encrypte.

Agressive Hacking

• Get salt code and rehash the data.

Hash attack

• Determine the Alphabet to Find passwords.
• 95 Caracter Standard keyboard/ may not exceed this limit.
• Password Polices may not apply.

Rainbow Tables

• Trade off between time frame
• Requires more Space for Slide and calculator

Dictionary Atacks.

• If password in the dictionary select different languages
• To make up tailors subject can be used.

Lists could contains Popular names, actors and people. Special dates, and common pets.