Input Validation and Authentication

• Input validation and authentication are vital security measures
• Dr. Alia Alabdulkarim prepared the content

Input Validation

• Never trust user input; consider it potentially harmful until validated
• Applications are created because users are the reason we create applications
• Emails and credit card data are examples of user inputs
• Validate user inputs, even if users trust applications for security from spam, etc.
• Two types of input validation approaches exist, "Blacklist validation" and "Whitelist validation"

Blacklist Validation

• A blacklist identifies invalid inputs and blocks anything matching the list
• Creates a list of possible unwanted malicious inputs
• Listing every possible unwanted or malicious input value is extremely difficult
• Blacklists will change over time

Blacklist Example - Restaurant Dress Code

• A restaurant dress code is presented as an example
• Listing all possible inappropriate clothing is challenging when creating a blacklist

Blacklist Failure Points

• Blacklisting is more difficult when preventing access to certain files or URLs
• The page being considered is www.site.cxx/my page.html
• Listing all possible ways to encode an apostrophe is an example of this difficulty

Whitelist Validation

• A whitelist lists out and matches only what should be allowed
• Any input not matching the whitelist is rejected

Whitelists and Input Types

• Drop-down lists or radio buttons indicate a type of validation
• Input must still be validated
• Car configuration applications give exterior paint color options of Midnight Blue, Sunset Red, and Canary Yellow
• The validation logic compares user input against the list of the 3 options
• Entering Shimmering Silver will cause a crash because it is not a valid option

Whitelist Security

• It is impossible to defend server-side logic by implementing defenses on the client side
• Validation logic on the client side can be bypassed
• Attackers can bypass user input constraints set by user interface objects like dropdown lists

Regular Expressions (Regex)

• Regular expressions check the incoming value against a predefined list to validate a choice
• Regular expressions are not usable for all inputs; for example, email addresses can not be checked
• Regular expressions are methods for whitelist validation logic for more complicated applications
• The expressions check all possible input, instead of checking against a predefined list
• Client-side validation improves performance
• It is recommended to re-use regular expressions that other people have created

Standard Expressions

• Regex includes email expressions such as ^[A-Z0-9._%+-]+@[A-Z0-9.-]+.[A-Z]{2,63}$
• Regex also includes date expressions such as ^(19|20)\d\d- /.- /.$

Attack Surface Reduction

• Attack surface = choke points = points of failure
• Attack surface includes application code, and functionality accessed by any untrusted user
• Attack surface is all of your application code and functionality
• Adding a new feature adds a potential point of failure in your application
• User features should be optional to activate or deactivate
• Known attacks effective defense, and a hedge against zero day is reducing the attack surface

Rules of Thumb

• Use "principle of least privilege"
• Grant users minimum permissions
• Authorization checks should be performed
• Use different access accounts to administer different types of users
• Minimize the different programming calls, and objects in code
• DataSets should be minimized to DataTable objects

Validation Best Practices

• Input validation and attack surface reduction are vital security practices by themselves

Authentication

• The process of proving that you are who you claim to be

Access Control Overview

• In web applications it must be ensured that users may only access protected assets
• A strong access control system is needed
• Access control is a mechanism regulating access to data or functionality

Definitions

• "Subject" is the person or thing doing something
• "Object" is the recipient or target of that action or the thing that is being requested
• There are 2 parts, first to prove their identity, and then to check if they should have access
• "Authorization" determines if the validated identity has rights to do what they want
• "Authentication" confirms their identity, such as username/password

Process

• Claim to be a certain identity by providing an identifier
• Prove that identity by providing an authentication factor
• Verification through the identity datastore
• If proven, a persistent authentication token is returned to the user

Authentication steps

• Identification and authentication (confirmation are the two steps
• Without authentication, authorization is not possible, and vice versa

Proving Identity

• Authentication classes are, something you know, something you have, and something you are

• Something you know

  • Passwords, PINs, passphrases

• Something you have

  • Digital certificates, smart cards

• Something you are

  • Fingerprint, hand geometry, topography of your face

Factors

• "Something" you know may be forgotten
• Easy passwords may be guessed
• Forgotten/compromised password reset mechanism must be provided
• "Something" "You have" now must constantly be with you
• Objects might be stolen
• "Something" "you are" must be intrinsic
• Biometric sensors are fairly expensive
• 2FA (2 factor authentication) utilizes 2 of the 3 authentication methods
• 3FA (3 factor authentication) utilizes all 3 authentication methods
• 2SV (2 step validation) using factors from one category
• More factors from the same class does not increase factors validated

Authentication Methods

• Usernames and passwords authenticate users to web applications
• Secondary factor such as hardware token may be used to increase authentication security
• The use of biometrics is almost unheard of for web applications

Password Based Systems

• Multiple username/password systems exist for web apps
  • Built-In HTTP, Single Sign On, and Custom authentication

Built in HTTP Authentication

• Basic access authentication supports no encryption
• It uses base64 encoding, and is easily decoded
• Digest access authentication uses MD5
• Digest access authentication is vulnerable to Man-In-The-Middle attacks (MIM)
• Basic access and Digest access authentication have significant weaknesses, and are not recommended in any circumstances

Single Sign On (SSO)

• Internet SSO allows users to log in to a single interface
• The user can independently secures systems, with one set of credentials

Google Accounts

• With it, the user can access Gmail, Drive, and YouTube

Microsoft's Live ID (Example)

• When logging on, you can use it to access Windows Live Hotmail, and Windows Live Messenger

Facebook Connect System (Example)

• This API allows third-party developers to use the authentication system on their own sites
• SSO pros include reduced number of credentials
• SSO cons include a single-point of failure and it is compromised, many websites are then compromised

Custom Authentication

• It is the most common authentication method
• The logic is coded into custom made applications
• Input validation is performed by the developer

Validating Credential

• There are several ways to validate
• It depends on location of the comparison, and how the passwords are being stored
• The comparison can be plaintext, or it can be hashed
• Hashes are stored on both the application and the database level
• Incorrect storage implementation can lead to SQL injections

Hashed Password example

• The $hashedPassword is the version of $userPassword that has been hashed, not the plaintext password

##Securing Password-Based Authentication

• It is the most popular way of confirming identity
• Attackers can attempt to break into these
• The best plan it to defends against attacks

Attacks

• Attacks are all attempts to guess login credentials
• They are present on the live system or on hashed/encrypted passwords
• The forms the attacks may come in are:
  • Dictionary attacks
  • Brute-force attacks
  • Pre-computed dictionary attacks
  • Rainbow tables
  • Rubber hose attacks
  • Videos

Password Complexity

• Main goal is to increase the key space (domain) by making it harder to guess passwords
• To make it difficult, it has to make it take as long as possible to exhaustively search the potential key space
• Increase the minimum length, use mixed character sets, and change them regularly

Password Practices

• Require password complexity. It should be a minimum of eight characters

• Enforce a "minimum password complexity" to include uppercase, lowercase, number, special character

• Proper storage is [plaintext – encrypted – hashed]

Authentication Best Practices

• It plays a fundamental role in access control
• There are things worth exploration
• "When" and "where" does authentication take place
• How can authentication mechanisms be more secure

Secure Practices

• Validate the cookie with every request
• Code should execute and authorize "every" request
• When privileges increase, update the cookie and issue the cookie again
• Amazon (before you place your order) is an example of re-authentication
• Always do it the "first" time you are challenged to gain access to protected resources

Web Authentication

• The transmission has to be secured through Secure Sockets Layer/Transport Layer Security

Account Lockout

• It should be offered after "X" amount of attempts
• It acts as a security measure against users attempting to gain access to your password via online password
• The time the account can be in this blocked state can also be customized

General Strategies

• Do not hard-code values, and the recommendation is to secure keys and credential with system access
• "Avoid remember me", provide it, but make sure remember a default for security reasons