2.4 - Authentication and Authorization Flashcards
What is a directory service?
It keeps all of the organization’s usernames and passwords in a single database (ex. AD).
Define federation and a federated network.
Federation : Providing network access to to others outside of the organization, not just employees - partners, suppliers, customers, etc.
Federated Network: Allows for authentication and authorization between two organizations (logging in with google credentials).
What is attestation?
Proving that the hardware is really yours or that the hardware is something that can be trusted interacting with or within a network.
Remote attestation: The device provides an operational report to a verification server. It is encrypted and digitally signed with the TPM. An IMEI or other unique hardware component can be included in the report.
How might one authenticate with SMS?
After you provided your login information, you receive an SMS to a predefined phone number.
What are some of the security issues that exist with SMS authentication?
1) The phone number can be reassigned to a
different phone
2) SMS messages can be intercepted
How might one authenticate with a push notification?
A similar process to SMS. The authentication factor is pushed to a specialized app. This is usually on a mobile device. More secure that SMS.
What are some of the security issues that exist with push notification authentication?
1) Applications can be vulnerable
2) Some push apps send in the clear
How might one authenticate with an authentication app?
A pseudo-random token generator on your phone.
Define TOTP.
Time-based One-Time Password algorithm
A secret key and the time of day are used to generate a token for authentication. The secret key is configured ahead of time, and timestamps are synchronized via NTP.
Google, Facebook, Microsoft, etc.
Define HOTP.
HMAC-based One-Time Password algorithm
Keyed- hash message authentication code (HMAC)
One- Time passwords are generated, once a session and each authentication attempt. The keys are based on a secret key and a counter. The hash is different every time.
How might one use a phone call to authenticate?
A voice call provides the token.
What are the security issues with using a phone call to authenticate?
1) Phone call can be intercepted or forwarded
2) Phone number can be added to another phone
What are some examples of static codes for authentication?
Personal Identification Number (PIN)
Password
Passphrase
How might one use a smart card to authenticate?
A smart card (something you have) can be used. It includes an integrated circuit, and it can be through contact or contactless. You must have the physical card.
Can be used in conjunction with other authentication methods.
What are some examples of biometric factors?
Fingerprint scanner, Retinal scanner, iris scanner, voice recognition, facial recognition
Gait analysis: Identify a person based on how they walk
Veins
What are the five types of authentication factors?
1) Knowledge Factor
- Something you know
2) Possession Factor
- Something you have
3) Inherence Factor
- Something you are
4) Location Factor
- Somewhere you are
5) Behavior Factor
- Something you exhibit
Define the False Acceptance Rate (FAR) in terms of biometrics.
The likelihood that an unauthorized user will be accepted. You can increase sensitivity to counter this.
Define False Rejection Rate (FRR) in terms of biometrics.
The likelihood that an authorized user will be rejected. Might be too sensitive.
Define Crossover error rate (CER) in terms of biometrics.
The overall accuracy of a biometric system or the rate at which FAR and FRR are equal. The sensitivity should be adjusted to equalize both values.
What is the AAA framework?
1) Identification
-This is who you claim to be
- Username
2) Authentication
3) Authorization
4) Accounting
What are the features of cloud-based authentication security?
Third-party can manage platform
Centralized Platform
Automation options with API integration
May include additional options (for a cost)
What are some of the features of an On-premises authentication system?
Internal monitoring and management
Internal expertise
External access must be granted and managed
List three authentication factors.
1) Something you know
2) Something you have
3) Something you are
List four authentication attributes.
1) Somewhere you are
2) Something you can do
3) Something you exhibit
4) Someone you know
What are some examples of Something you know?
Password
PIN
Pattern
What are some examples of Something you have?
Smart card
USB token
Hardware or software tokens (can be on a mobile
phone)
Your phone
What are some examples of Something you are?
Biometric
- Usually stores a mathematical representation of
your biometric
- Difficult to change
What are some examples of the attribute Somewhere you are?
Location
IP address can be used to gauge location
GPS
Mobile device location
What are some examples of the attribute Something you can do?
Handwriting
Signature
What are some examples of the attribute Something you exhibit?
Gait analysis
Typing analysis
What are some examples of the attribute Someone you know?
Digital signature
Web of trust
Social Factor
