Métodos de Autenticación

Authentication Methods

• Identification: A method where a subject (user, program, or process) claims an identity (e.g., username, account number, email).
• Authentication: Verifying the subject's identity, usually by requiring information only the claimed identity should possess.
• Credentials: Consists of an identification claim (username) and authentication information (password).
• Authorization: Determining if a subject has the necessary rights to perform requested actions.
• Authentication Factors: Three main types:
  • Something the person knows (e.g., password).
  • Something the person has (e.g., token).
  • Something the person is (e.g., fingerprint).
  • Additional factors: Location (geolocation) and actions (keystroke behavior).
• Knowledge-based Authentication: Uses information the person knows (e.g., password, passphrase).
• Salts: Random values added to passwords before hashing to improve security.
• Cognitive Passwords: Fact- or opinion-based questions, typically based on life experiences, used for verification.
• Biometric Authentication Errors:
  • Type I Error: Legitimate individual denied access.
  • Type II Error: Impostor granted access.
  • Crossover Error Rate (CER): Point where false rejection rate equals false acceptance rate in biometric systems.
• Ownership-based Authentication: Based on something a person owns (e.g., token device).
• Token Device: Usually a handheld device that synchronizes with a service to provide temporary passwords (one-time passwords - OTPs).
  • Synchronous Token Device: Device and service must be in sync for OTP generation.
  • Asynchronous Token Device: Uses a challenge-response scheme for authentication.
• Smart Card: Stores information and has the hardware/software to process it.
• Memory Card: Stores information but cannot process it independently.

Identity and Access Management (IAM)

• Password Managers/Vaults: Solutions for managing complex passwords.
• Just-in-Time (JIT) Access: Granting necessary privileges for specific tasks.
• User Provisioning: Creating, maintaining, and deactivating user objects in systems, directories, or applications.
• Authoritative System of Record (ASOR): Hierarchical tree-like structure to track subjects and authorization.
• Session: Agreement between two parties to communicate interactively.
• Auditing: Tracking actions, verifying security policies, supporting investigations.
• Scrubbing: Deleting incriminating data in audit logs.
• Identity Management (IdM): Using various products for automated user identification, authentication, and authorization.
• Directory Services: Associating resource names with network addresses, facilitating communication between devices, files, users, etc..
• Lightweight Directory Access Protocol (LDAP): Common directory service protocol.
• Single Sign-On (SSO): Authenticating once to access multiple resources.
• Federated Identity: Portable identity recognized across multiple IT systems and enterprises.
• Identity as a Service (IDaaS): Cloud-based offering for SSO, Privileged Identity Management (PIM), and password management.
• Identity Management Architectures: On-premise, cloud-based, and hybrid.