Knowledge-Based Authentication and Security Keys

Knowledge-Based Authentication (KBA)

• Authenticates users by asking them secret questions.
• Often used as part of multi-factor authentication (MFA) or for password retrieval.
• Dynamic KBA verifies identity without requiring users to pre-set questions and answers

Something You Have

• Smart card - Requires Public Key Infrastructure (PKI) & Embedded certificate
• Tokens or Key Fobs - Display one-time passwords (OTPs) that change periodically.
  • HOTP - Uses HMAC (Hash-based Message Authentication Code) and a counter to create an OTP that remains valid until used.
  • TOTP - Similar to HOTP but uses a timestamp instead of a counter. OTPs expire after 30 seconds.
• CACs and PIVs - Common Access Cards (DoD) and Personal Identity Verification (Federal Agencies).

Security Keys

• Physical devices that add an extra layer of security to online accounts.
• Often resemble thumb drives or tags.
• May include features like near-field communication (NFC) or fingerprint scanners.
• Used for 2FA or MFA to protect against account takeover.

Soft Tokens

• Digital security devices that generate OTPs for 2FA or MFA.
• Typically apps installed on computers or mobile devices.
• Used to protect sensitive data and network information.

Types of Biometrics

• Fingerprint
• Vein Matching
• Retina Imaging
• Iris Scan
• Facial Recognition
• Voice Recognition
• Gait Analysis

Something You Do

• Signature Dynamics - Analyzed for user recognition
• Voice-Scan
• Keyboard Dynamics - Tracks typing patterns for authentication.

Somewhere a User is (Geolocation)

• Authenticates users based on their GPS location.

Multifactor Authentication (MFA)

• Requires two or more authentication factors.
• Common combinations:
  • Something you know (password) AND something you have (security key).
  • Something you know (password) AND something you are (biometrics).

Privileged Access Management (PAM)

• Protects organizations by monitoring, detecting, and preventing unauthorized access to critical resources.
• Also known as Privileged Identity Management (PIM) or Privileged Access Security (PAS)

Disabling and Deleting User Accounts

• Organizations often have policies for managing user accounts, including disabling or deleting accounts.
• Disabling is preferred over deleting, as deleting also removes encryption and security keys.

Attestation

• Verifies and manages access to systems, applications, and resources.
• Ensures only authorized individuals have access based on their roles and responsibilities.
• A key component of identity governance, crucial for information security.

Comparing Authentication Services

• Federation and Trusts (ADFS) - Defines policies for managing identities across systems and organizations. Allows access across domains.
  • Trust relationships can be:
    • One-way (child trusts parent)
    • Two-way (mutual trust)
    • Non-transitive (trust only between specific domains)
    • Transitive (trust extends to other trusted domains)

SAML (Security Assertion Markup Language)

• An open standard for exchanging authentication and authorization data.
• XML-based. Enables Single Sign-On (SSO).
• Identity providers (IdP) authenticate users and pass tokens to service providers (SP) for authorization.

OAuth

• An open standard authorization protocol. Allows applications secure access to resources.
• Example: Allowing ESPN to access your Facebook profile without giving them your password.
• Focuses on authorization, while SAML is designed for authentication and authorization.

Discretionary Access Control (DAC)

• Access permissions are set by the data owner.
• Subject's permissions can be inherited by programs they execute.

Mandatory Access Control (MAC)

• Based on security clearance of the subject and classification of the object (resource).
• Each user assigned a clearance level, and objects have classification labels.
• Access decisions are made by the system, not the data owner.
• Used in highly secure environments.
• Typically used for classified data.

Attribute-Based Access Control (ABAC)

• Assigns access and privileges based on attributes or characteristics.
• Attributes include:
  • Object or Resource Attributes
  • Subject Attributes
  • Environment Attributes
• Most flexible access control model.