Domain 5: Authentication Methods Flashcards
- Authentication method
- Testing the subject with some sort of challenge and response where the subject must respond with a knowledgeable answer
- i.e. password or PIN
Type 1 Authentication: Something You Know
- Type of Password
- Reusable passwords that may or may not expire
- Typically user-generated
Static Passwords
- Type of Password
- Long passwords comprised of words in a phrase or sentence
- i.e. “I will pass the CISSP”
Passphrases
- Type of Password
- Authentication that is only valid for one-time use
One-time Passwords
- Type of Password
- Authentication that changes at regular intervals
- i.e. RSA security token
Dynamic Passwords
- The process of trying to predict a password in order to authenticate while online
- Account lockouts is a prevention
Password guessing
Attacker has gained access to the password hashes or database and compares the output to a desired hash hoping to find a match therefore deriving the original password
Password Cracking
- Password Attack
- Uses a word list each of which is hashed
- Cracking software matches hash output to the password hash; if a match we‘ve identified the password
Dictionary Attack
- Password Attack
- Appends, prepends, or changes characters in words from a dictionary before hashing in order to attempt the fastest crack of complex password
Hybrid Attack
- Password Attack
- Attacker calculates the hash outputs for every possible password.
Brute-Force Attacks
Database that contains the precomputed hashed output for most of all possible passwords
Rainbow table
- Random value added to the plaintext password before hashing
- Adds complexity to hashed password stored in database
- Protects against rainbow attacks
Salt
- Authentication method
- Requires that users possess something
- i.e. token
Type 2 Authentication: Something You Have
- Time-based and synchronized with an authentication server (AS).
- New password generated periodically (i.e. every 60 secs)
- Does require the token and the server to have accurate time
Synchronous Dynamic Passwords
- Creates a dynamic one time password that stays the same until used for authentication
- Hardware token generates passwords based on an algorithm and an incrementing counter
- Does not use a clock
Asynchronous Dynamic Passwords
- Authentication method
- Uses a physical characteristics as a means of identification or authentication
- i.e. facial recognition system or fingerprint
Type 3 Authentication: Something You Are
The process of registering with the biometric system
Biometric Enrollment
- The process of authenticating to a biometric system
- Typically 6-10 secs
Throughput
- Occurs when an authorized subject is rejected by the biometric system as unauthorized
- Type I error
False Rejection Rate
- Occurs when an unauthorized subject is accepted as valid
- Type II error
False Acceptance Rate
- The point where False Rejection Rate and False Acceptance Rate are equal
- Describes the overall accuracy of a biometric system
- AKA Equal Error Rate (EER)
Crossover Error Rate
Most widely used biometric control
Fingerprints
Includes specific details of fingerprint friction ridges like whorls, ridges and bifurcation
Minutiae
- Laser scan of capillaries that feed the back of the eye
- This biometric control raises privacy concerns because conditions such as pregnancy and diabetes can be determined
- Rarely used
Retina scan
- Camera takes a picture of the colored portion of the eye and then compares photos within the authentication database
- Scan even works if person is wearing contact lenses or glasses
- This is unique on every person, including twins
Iris scan
- Biometric control
- Takes measurements from specific points on a subject’s hand
Hand Geometry
- Biometric control
- Refers to how hard a person presses each key and the rhythm in which the keys are pressed.
Keyboard Dynamics
- Biometric control
- Measures the process by which someone signs his/her name
Dynamic Signatures
- Biometric control
- Measures the subject’s tone of voice while stating a specific sentence or phrase
Voiceprint
- Biometric control
- Process of taking a picture of a subjects face and comparing that picture to a list stored in a database
Facial scan
- Describes location-based access control using technologies
- i.e. GPS, IP address-based geolocation
Someplace You Are
- OASIS standard typically used to define access control policies i.e. attribute-based or role-based
- Most commonly used by software-define-networking systems
Extensible Access Control Markup Language (XACML)
- Used for federated identity SSO
- Based on DSML, which is used to present LDAP info in XML format
Security Provisioning Markup Language (SPML)
- Large constant value added to the plaintext password before hashing
- Value is stored somewhere outside the database holding the hashed passwords
Pepper
What are some algorithms that add a salt to a password and repeat the hashing function many times?
bcrypt
Password-Based Key Derivation Function 2 (PBKDF2)
- Type 3 authentication factor
- Behavioral biometrics i.e. signature and keystroke dynamics
Something-you-do
- ID or badge that has an integrated circuit chip embedded in it
- Certificate inside microprocessor can be used for authentication, to encrypt data, digitally sign email and etc…
Smartcard
Card that holds authentication information for a user
Memory card
Authentication method that uses situational info (i.e. identity, geolocation, geofence, time of day, type of device) to determine who can access a network
Context-Aware authentication
Virtual perimeter identifying the location of the building and can identify when a user is in the building
Geofence
Series of challenge questions about facts or predefined response that only the subject should know
Cognitive Passwords
- Worn smartcards by personnel within the US government
- Users wear them while walking around and insert them into card readers at their computer when logging on
Common Access Cards (CACs)
Personal Identity Verification (PIV)
- Standard to create one time passwords
- Typically creates values of six to 8 numbers
- Values remain valid until used
HMAC-based One-Time Password (HOTP)
- Standard to create one time passwords
- Uses a timestamp and remains valid for a certain timeframe (i.e. 30 secs)
- Password expires if user does not use within timeframe
Time-based One-Time Password
- Biometric control
- Use near-infrared light to measure vein patterns in the palm, which are as unique as fingerprints
Palm scanners
- Biometric control
- Ensures that a real person is providing the biometric factor
Heart/Pulse Patterns
Database where users biometric data is stored
Reference profile
