Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cybersecurity > Chapter 3 - User Authentication > Flashcards

Chapter 3 - User Authentication Flashcards

1
Q

User Authentication Simple Definition

A

The process of verifying an identity claimed by or for a system entity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

NIST Definition of User Authentication

A

The Process of establishing confidence in user identities presented electronically to an information system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is User Authentication considered?

Role in Security System

A
  • Fundamental building block
  • primary line of defense in computer security
  • basis for most types of access control and accountability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Two steps in the authentication process

A
  1. Identification: Presenting an identifier to the system
  2. Verification: confirm binding between the entity and the identifier
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Is FaceID identifier or verifier?

A

Verifier because it validates identity by comparing face to stored facial data.

Identifier is implicit!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

4 means of authenticating user identity and issues with each

Something the individual: _____

A
  1. Something individual knows
    (Password, PIN, answer to security questions) - must be as secure as the password
    - Password guessing/stealing/forgetting
  2. Something the individual possesses Token
    (Smartcard, electronic keycard, physical key)
    - theft/loss
  3. Something the individual is
    (Static biometrics like fingerprint, retina or face)
    - false positives/negatives
    - user acceptance issues
    - inconvenience to set up
  4. Something the individual does
    (dynamic biometrics like voice pattern, handwriting, or typing ryhythm)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is password-based authentication?

A

Method where a user provides a name/(loginID) and a password, which the system compares with a stored password for that login

userID
1. Authorized to enter system?
2. Which privileges?
3. Access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Password Vulnerabilities (8)

Eric, Please Offer Spectacular Passwords When Making Users

A
  • Electronic monitoring
  • Password guessing (against single user)
  • Offline dictionary attacks
  • Specific account attacks
  • Popular password attacks
  • Workstation hijacking
  • Exploiting user mistakes
  • Exploiting multiple password use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Popular Password Attack

Password Vulnerabilities

A

Attacker gains unauthorized access by guessing popular passwords

make policies against selection of commonly used passwords (prevent), scan ip address of authentication requests (detect)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Password Guessing (against single user)

Password Vulnerabilities

A

Guessing against a specific user

min length, character set, training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Electronic monitoring

Password Vulnerabilities

A

Malware that records every keystroke a user types

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Offline dictionary attack

Password Vulnerabilities

A

Attacker obtains database of hashed passwords and compares them against hash values of commonly used passwords

Access contols (prevent) intrustion detection (detect) rapid reissuance of passwords (respond)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Specific Account Attacks

Password Vulnerabilities

A

Gathering personal information about a user to guess password

Accout lockout mechanisms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Example of workstation hijacking

Password Vulnerabilities

A

Attacker accesses a logged-in workstation that was left unattended

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Example of Exploiting user mistakes

Password Vulnerabilities

A

User leaves password on a sticky note on desk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Example of multiple passwords use

Password Vulnerabilities

A

Attacker gains access to one account and reuses the credentials to access the user’s email or banking accouts

salting helps prevent this!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Online vs. Offline password attacks

A

Online: Requires interaction with a service or resource

Offline: Works with intercepted or stolen data (password files)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Countermeasures (8)

Password Countermeasures

A
  • Prevent unauthorized password files access
  • Intrusion detection measures
  • Rapid reissuance of compromised passwords
  • Account lockout mechanisms
  • Policies against using common passwords and using similar passwords on network devices
  • Regular password reissuance
  • Training in and enforcement of password policies
  • Automatic workstation logout
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Account Lockout Mechanisms

Password Countermeasures

A

The account is locked after a given number of failed attempts

*Has a downside: Can be abused for denial of service attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Why are passwords the most common authentication technique despite all the vulnerabilities?

A
  • tokens expensive and inconvenient to carry around
  • biometrics depend on client side hardware and it requires specific software implemnation on both sides, usually one side reluctant
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Why should passwords NEVER be stored “in clear” ?

Password Countermeasures

A
  • Sysadmin could access all user’ passwords
  • Intruder would get a very valuable asset

BTW: Never email password!!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are hashed and salted passwords?

Password Countermeasures

A

Passwords are transformed using a hash function

with a salt value, or random value added to each password before hashing to make attacks harder

Salt values are stored in the password value in clear

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How is password verified with salting and hashing?

Password Countermeasures

A
  1. User enters password
  2. Retrieve user’s salt value from password file
  3. Combine them, and pass through hash function
  4. Compare newly computed hash with stored hash
24
Q

Why is salting important in password storage? (2)

Password Countermeasures

A
  1. It prevents duplicate passwords from being visible in the password file, increasing the difficulty of offline dictionary attacks (attacker has to add all possible salts to commonly used passwords, will take forever)
  2. Becomes nearly impossible to find out whether a person with passwords on two or more systems has used the same password

(salt of b bits increases number of possible passwords by a factor of 2^b)

Salt ensures that each password has a unique hash

25
Q

Whys is it a “slow” hash function in salt & hashing?

Password Countermeasures

A

This delay makes it computationally expensive for attackers to execute brute-force attacks

26
Q

Old salting vs new salting

Password Countermeasures

A
  • 12-bit salt using DES encryption into a one-way hash function (based on MD5, which is not SHA512)
  • 48-bit+ salt using Bcyrpt hash algorithm (Blowfish block cipher)
27
Q

Shadow password file

Password Countermeasures

A

Separate file from the user IDs where the hashed passwords are kept

28
Q

User Education

Password Countermeasures

A

Users told importance of using hard to guess passwords, provided with guidelines

29
Q

Computer generated passwords

Password Countermeasures

A

Hard to guess for attackers but users have trouble remembering them

Could use password managers

30
Q

Reactive password checking

Password Countermeasures

A

System periodically runs its own password cracker to find guessable passwords

cancel those guessed and notify user

31
Q

Proactive password checking

definition and 2 examples

A

User checks if user selected password is allowable at time of selection and if not rejects it

  1. Rule enforcement (basic16 > comprehensive8)
  2. Password checker (compile dictionary of “bad passwords”)

Goal: Eliminate guessable passwords while allowing memorable passwords

32
Q

What is the problem with traditional UNIX password scheme?

What is the recommended hash instead?

A

It uses DES cipher which is insecure, but this scheme is still required with many accout management softwares for compatibility reasons

MD5 with 48 bit salt and 128 bit hash value that uses an inner loop with 1000 iterations to slow it down (longer to crack)

33
Q

Most secure Unix hash/salt scheme

A

developed for OpenBSD, the “Bcrypt” hash function. 55 character max for password, 128 bit salt, outputs to 192 bit hash value.

Can configure a cost variable to increase hash time more

34
Q

Methods for proactive password checking

Password Countermeasures

A
  • Specific rules
  • Password cracker (large dictionary of passwords not to use + variations)
  • Neural networks-based evaluation
  • Password invalidation based on public data breaches
35
Q

Dictionary Attack

Password Cracking

A

Attacker obtains password file, develops a dictionary of possible passwords, then hashes each possible password (with the salt value) and then compares to stored hash values in the password file

each password hashed with EVERY salt… takes awhile

36
Q

Rainbow table attacks

Password Cracking

A

Attacker precomputes hashes from possible passwords (assuming a hash function) and creates a mammoth table that maps passwords (rainbow table) to hash values (in password file)

Large salt makes it too difficult.

If attacker can match a hash in their table to hash stored in password file, they have cracked the password

37
Q

Why is rainbow table attack more efficient than dictionary?

Password Cracking

A

Instead of computing the hash for each password guess in real-time, it compares to stored hashes in rainbow table

Rainbow tables can be resused if no salt was uses!

trade off space for time

1.4 gb of data was shown to crack 99.9% of all alphanumeric windows passwords

38
Q

How does an attacker get a password file? (5)

sniff some ass, booty back

A
  1. Exploit software vulnerability in OS to bypass access control system (at least for long enough to steal that file!)
  2. Accident of protection rendering password file readable
  3. Find copy on backup/archival disk physical security weakness
  4. Boot disk from another operating system
  5. Sniffing network traffic
39
Q

Password Cracking using AI (Example)

Password Cracking

A

PassGAN: Generative adversarial networks generate password guesses after learning distribution of passwords by processing the spoils of previous real-world breaches

40
Q

What was the password cracking method used in T6?

Password Cracking

A

John the Ripper

Popular open source password cracker that combines brute-force and dictionary techniques

41
Q

Alarming Password Statistics

A
  • 9.8% of users have the password “password” “123456” or “12345678”
  • 91% of users have a password from teh top 1000 passwords
42
Q

What is multi-factor authentication (MFA)?

MFA

A

Authentication that uses two or more methods

EX

  1. Something the user knows (password)
  2. Something the user has (dynamic PIN or device-generated code)

SMS are not good for security

43
Q

MFA can be good, but…

MFA

A

Must consider the security of the channel used for 2nd step of verification:

  1. IN band: single device use to input both factors
  2. OUT band: on multiple devices
44
Q

What is a passkey?

A

A replacement for traditional passwords that uses public-key cryptography, storing the key on local devices and resisting phishing attacks

Goal to completely replace traditional username and passwords

45
Q

Benefits of passkeys

A

Stored locally, reducing server-side breach impact
Better usability compared to traditional passwords

Can also use biometric verification

46
Q

How do passkeys resist phishing attacks?

A

Phishers don’t have access to the private key securely stored locally on device

47
Q

What are memory cards and smartcards in token-based authentication?

Token Based Authentication

A

Memory cards: Store data but do not process it (magnetic stripe cards)

Smartcards: Include embedded microprocessors (does your card have a “chip”?)

48
Q

Memory Card Drawbacks (4)

Token-Based Authentication

A
  • Requires special reader
  • Loss or theft
  • Information often stored in clear
  • Good for ATM but inconvenient for personal computer

Does hotel properly reprogram lock at each room change?

Do MUCH better with pin

49
Q

2 types of smart card electronic interfaces

A
  1. contact: insert card into reader (conductive plate, gold)
  2. contactless: radio frequencies to connect from inches away (card chip often powered by electromagnetic signal from reader!)
50
Q

Authentication Protocols for Smartcards

Token-Based Authentication

A
  1. Static: user authenticates himself to token, then token authenticates user to computer (similar to memory card)
  2. dynamic password generator (token generates unique password periodically, password entered into computer)
  3. challenge-response (computer generates challenge, smart token generates response) ex - token encrypts a challenge string with token’s private key
51
Q

Components of smart card

A
  • microprocessor (can have coprocessor dedicated to cryptography to speed it up)
  • memory (ROM, EEROM, RAM
  • I/O ports (wireless or through electrical contacts with insert reader)
52
Q

What is remote user authentication

Remote User Authentication

A

verifying user identity over a network, requiring protocols to defend against threats eavesdropping, replay attacks, and password interception

Generally rely on challenge-response protocol

53
Q

Password protocol in remote authentication

A

instead of transmitting just hash of password, transmit (from user endpoint to system) function where hashed password is one of the arguments

  1. use random number as one of arguments
  2. prevents replay attack because adversary can’t resend the content in data packet, it won’t contain the hashed password and the random number ensures that each remote authentication attempt is singular
54
Q

What is a replay attack

A

when an attacker captures a valid authentication message and reuses it to gain unauthorized access

55
Q

Attacks on user authentication (6)

A
  1. client attacks
  2. host attacks
  3. eavesdropping/theft/copying
    4.replay attacks
    5.trojan horse
    6.denial of service

Cybersecurity (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions