Domain 5.0 Chapter 13 Flashcards
Managing Identity and Authentication
- Control physical and logical access to assets
Note that assets can be tangible or intangible.
1.1 Information
1.2 Systems
1.3 Devices
1.4 Facilities
1.5 Applications
1.
1.1 Information An organization’s information includes all of its data. Data is stored in simple files on servers, computers, and smaller devices. It can also be stored in databases within a server farm. Logical access controls attempt to prevent unauthorized access to the information.
1.2 Systems An organization’s systems include any IT systems that provide one or more services. For example, a simple file server that stores user files is a system. Additionally, a web server working with a database server to provide an ecommerce service is a system. Permissions assigned to user and system accounts control system access.
1.3 Devices Devices refer to any computing system, including routers, switches, servers, desktop computers, portable laptop computers, tablets, smartphones, and external devices such as printers. Organizations have increasingly adopted policies allowing employees to connect their personally owned devices (such as smartphones or tablets) to an organization’s network. Although the employees may own the devices, organizational data stored on the devices is still an asset of the organization.
1.4 Facilities An organization’s facilities include any physical location that it owns or rents. This could be individual rooms, entire buildings, or whole complexes of several buildings. Physical security controls help protect facilities.
1.5 Applications Applications frequently provide access to an organization’s data. Controlling access to applications provides an additional layer of control for the organization’s data. Permissions are an easy way to restrict logical access to applications and be assigned to specific users or groups.
1.1 Информация Информация об организации включает в себя все ее данные. Данные хранятся в простых файлах на серверах, компьютерах и небольших устройствах. Его также можно хранить в базах данных внутри фермы серверов. Логические средства контроля доступа пытаются предотвратить несанкционированный доступ к информации.
1.2 Системы К системам организации относятся любые ИТ-системы, которые предоставляют одну или несколько услуг. Например, простой файловый сервер, на котором хранятся пользовательские файлы, является системой. Кроме того, веб-сервер, работающий с сервером базы данных для предоставления услуг электронной коммерции, является системой. Разрешения, назначенные учетным записям пользователей и систем, контролируют доступ к системе.
1.3 Устройства Под устройствами понимается любая вычислительная система, включая маршрутизаторы, коммутаторы, серверы, настольные компьютеры, портативные ноутбуки, планшеты, смартфоны и внешние устройства, такие как принтеры. Организации все чаще принимают политики, позволяющие сотрудникам подключать свои личные устройства (например, смартфоны или планшеты) к сети организации. Хотя устройства могут принадлежать сотрудникам, организационные данные, хранящиеся на устройствах, по-прежнему являются активом организации. 1.4 Помещения Помещения организации включают любое физическое помещение, которым она владеет или арендует. Это могут быть отдельные помещения, целые здания или целые комплексы из нескольких зданий. Средства физической безопасности помогают защитить объекты.
1.5 Приложения Приложения часто предоставляют доступ к данным организации. Контроль доступа к приложениям обеспечивает дополнительный уровень контроля над данными организации. Разрешения — это простой способ ограничить логический доступ к приложениям и назначить их конкретным пользователям или группам.
- Controlling Physical and Logical Access
A physical security control is one you can touch, such as perimeter security controls (fences, gates, guards, and turnstiles) and environmental controls such as heating, ventilation, and air-conditioning (HVAC) systems and fire suppression.
Logical access controls are the technical controls used to protect access to information, systems, devices, and applications. They include authentication, authorization, and permissions. Combined, they help prevent unauthorized access to data and configuration settings on systems and other devices.
К элементам физического контроля безопасности можно прикоснуться, например, к элементам управления безопасностью по периметру (заборы, ворота, охрана и турникеты) и к средствам контроля окружающей среды, таким как системы отопления, вентиляции и кондиционирования воздуха (HVAC), а также пожаротушения.
Логический контроль доступа — это технический контроль, используемый для защиты доступа к информации, системам, устройствам и приложениям. Они включают аутентификацию, авторизацию и разрешения. В совокупности они помогают предотвратить несанкционированный доступ к данным и настройкам конфигурации систем и других устройств.
- The CIA Triad and Access Controls
One of the primary reasons an organization implements access control mechanisms is to prevent losses. There are three categories of IT loss: loss of confidentiality, integrity, and availability (CIA).
The following list identifies them in the context of access control:
Confidentiality Access controls help ensure that only authorized subjects can access objects. When unauthorized entities can access systems or data, it results in a loss of confidentiality.
Integrity Integrity ensures that data or system configurations are not modified without authorization, or if unauthorized changes occur, security controls detect the changes. If unauthorized or unwanted changes to objects occur, it results in a loss of integrity.
Availability Authorized requests for objects must be granted to subjects within a reasonable amount of time. In other words, systems and data should be available to users and other subjects when they are needed. If the systems are not operational or the data is not accessible, it results in a loss of availability.
Триада ЦРУ и контроль доступа
В следующем списке они идентифицируются в контексте контроля доступа: -
- Конфиденциальность Контроль доступа помогает гарантировать, что только авторизованные субъекты смогут получить доступ к объектам. Когда неавторизованные лица могут получить доступ к системам или данным, это приводит к потере конфиденциальности.
- Целостность Целостность гарантирует, что данные или конфигурации системы не будут изменены без разрешения, а в случае возникновения несанкционированных изменений меры безопасности обнаружат эти изменения. Если происходят несанкционированные или нежелательные изменения объектов, это приводит к потере целостности.
- Доступность Разрешенные запросы на объекты должны быть предоставлены субъектам в течение разумного периода времени. Другими словами, системы и данные должны быть доступны пользователям и другим субъектам, когда они необходимы. Если системы не работают или данные недоступны, это приводит к потере доступности.
- Managing Identification and Authentication
Identification is the process of a subject claiming, or professing, an identity.
Providing an identity might entail typing a username, swiping a smartcard, speaking a phrase, or positioning your face, hand, or finger in front of a camera or in proximity of a scanning device.
Authentication verifies the subject’s identity by comparing one or more factors against a database of valid identities, such as user accounts.
Identification and authentication occur together as a single two-step process.
While identification and authentication methods authenticate people, they also authenticate devices and services.
Subject A subject is an active entity that accesses a passive object to receive information from, or data about, an object. Subjects can be users, programs, processes, services, computers, or anything else that can access a resource. When authorized, subjects can modify objects.
Object An object is a passive entity that provides information to active subjects. Examples of objects are files, databases, computers, programs, processes, services, printers, and storage media.
- Управление идентификацией и аутентификацией
- Registration, Proofing, and Establishment of Identity
Acceptable documentation for in-person identity proofing includes using physical documents such as a passport, driver’s license, birth certificate, and more.
Online organizations often use knowledge-based authentication (KBA) for identity proofing of someone new, such as a new customer. For example, if you create an online savings account, the bank will ask you a series of multiple-choice or fill-in-the-blank questions that only you should know. (What is your driver’s license number?). The organization queries independent and authoritative sources, such as credit bureaus or government agencies, before creating these questions.
Some organizations use a cognitive password (also known as security questions) when a known user is trying to change a password. (What is the name of your first pet?). Later, the system uses these questions for authentication. If the user answers all the questions correctly, the system authenticates the user. Cognitive passwords often assist with password management using self-service password reset systems or assisted password reset systems.
- 2 Authorization and Accountability
Two additional security elements in an access control system are authorization and accountability:
Authorization Subjects are granted access to objects based on proven identities. For example, administrators grant users access to files based on the user’s proven identity.
Accountability Users and other subjects can be held accountable for their actions when auditing is implemented. Auditing tracks subjects and records when they access objects, creating an audit trail in one or more audit logs. For example, auditing can record when a user reads, modifies, or deletes a file. Auditing provides accountability.
2.3 Authentication Factors
There are three primary authentication factors:
2.3.1 Something You Know The something you know factor of authentication includes memorized secrets such as a password, personal identification number (PIN), or passphrase. Older documents refer to this as a Type 1 authentication factor.
2.3.2 Something You Have The something you have factor of authentication includes physical devices that a user possesses and can help them provide authentication. Examples include a smartcard, hardware token, memory card, or Universal Serial Bus (USB) drive. Older documents refer to this as a Type 2 authentication factor.
2.3.3 Something You Are The something you are factor of authentication uses physical characteristics of a person and is based on biometrics. Examples in the something you are category include fingerprints, face scans, retina patterns, iris patterns, and palm scans. Older documents refer to this as a Type 3 authentication factor.
Существует три основных фактора аутентификации:
- Что-то, что вы знаете Фактор аутентификации “то, что вы знаете” включает в себя запомненные секреты, такие как пароль, личный идентификационный номер (PIN) или парольную фразу. В более старых документах это называется фактором аутентификации типа 1.
- Что-то, что у вас есть Фактор аутентификации «что-то, что у вас есть» включает в себя физические устройства, которыми обладает пользователь, и которые могут помочь ему обеспечить аутентификацию. Примеры включают смарт-карту, аппаратный токен, карту памяти или диск универсальной последовательной шины (USB). В более старых документах это называется фактором аутентификации типа 2.
- Что-то, чем вы являетесь Что-то, чем вы являетесь, фактор аутентификации использует физические характеристики человека и основан на биометрии. Примеры категории «то, кем вы являетесь» включают отпечатки пальцев, сканы лица, узоры сетчатки, узоры радужной оболочки и сканы ладоней. В более старых документах это называется фактором аутентификации типа 3.
2.4 Single/multi-factor authentication
Single-factor authentication uses only one authentication factor. Multifactor authentication uses two or more authentication factors.
These types are progressively stronger when implemented correctly, with something you know being the weakest and something you are the strongest. In other words, passwords are the weakest form of authentication, and a fingerprint is stronger than a password.
In addition to the three primary authentication factors, attributes are sometimes used for additional authentication. These include the following:
2.3.4 Somewhere You Are The somewhere you are factor identifies a subject’s location based on a specific computer, a geographic location identified by an Internet Protocol (IP) address, or a phone number identified by Caller ID. Controlling access by physical location forces a subject to be present somewhere. Geolocation technologies can identify a user’s location based on the IP address, and some authentication systems use geolocation.
2.3.4 Context-Aware Authentication Many mobile device management (MDM) systems use context-aware authentication to identify mobile device users. It can identify multiple attributes such as the user’s location, the time of day, and the mobile device. Organizations frequently allow users to access a network with a mobile device, and MDM systems can detect details on the device when a user attempts to log on. If the user meets all the requirements (location, time, and type of device in this example), it allows the user to log on using the other methods, such as with a username and password.
Эти типы становятся все сильнее при правильной реализации: что-то, что вы знаете, является самым слабым, а что-то — самым сильным. Другими словами, пароли являются самой слабой формой аутентификации, а отпечаток пальца надежнее пароля.
Помимо трех основных факторов аутентификации, для дополнительной аутентификации иногда используются атрибуты. К ним относятся следующие: Где вы находитесь Фактор “Где вы находитесь” определяет местоположение субъекта на основе конкретного компьютера, географического местоположения, определяемого IP-адресом, или номера телефона, определяемого идентификатором вызывающего абонента. Контроль доступа по физическому местоположению заставляет субъект где-то присутствовать. Технологии геолокации могут определять местоположение пользователя на основе IP-адреса, а некоторые системы аутентификации используют геолокацию.
Контекстно-зависимая аутентификация Многие системы управления мобильными устройствами (MDM) используют контекстно-зависимую аутентификацию для идентификации пользователей мобильных устройств. Он может идентифицировать несколько атрибутов, таких как местоположение пользователя, время суток и мобильное устройство. Организации часто разрешают пользователям доступ к сети с помощью мобильного устройства, а системы MDM могут обнаруживать сведения об устройстве, когда пользователь пытается войти в систему. Если пользователь соответствует всем требованиям (местоположение, время и тип устройства в этом примере), он позволяет пользователю войти в систему, используя другие методы, например, с использованием имени пользователя и пароля.
2.3.1 Something You Know
The most common authentication technique is the password.
A static password stays the same for a length of time, such as 60 days, but static passwords are the weakest form of authentication.
One way of strengthening a password is by using a passphrase.
The following list includes some common password policy settings:
Maximum Age This setting requires users to change their password periodically, such as every 45 days. Some documents refer to this as password expiration.
Password Complexity Password complexity refers to how many character types it includes. Complex passwords use three or four character types.
Password Length The length is the number of characters in the password, such as at least eight characters long.
Minimum Age This setting prevents users from changing their password again until a certain time has passed.
Password History A password history remembers a certain number of previous passwords and prevents users from reusing passwords.
Several authoritative sources of password policy:
- NIST SP-800-63B, “Digital Identity Guidelines: Authentication and Lifecycle Management”
- Payment Card Industry Data Security Standard (PCI DSS) version 3.2.1
2.3.1.1 NIST SP-800-63B, “Digital Identity Guidelines: Authentication and Lifecycle
he following list summarizes the changes recommended by NIST:
Passwords must be hashed. Passwords should never be stored or transmitted in cleartext.
Passwords should not expire. Users should not be required to change their passwords regularly, such as every 30 days. Users often changed a single character when forced to change their password. For example, they would change Password1 to Password2. Although this complies with the requirement to change the password, it doesn’t add to security. Attackers use the same methods when guessing passwords.
Users should not be required to use special characters. Requiring users to include special characters often challenged users’ memory, and they wrote these passwords down. Further, NIST analyzed breached password databases and discovered that special characters in passwords didn’t provide the desired benefits.
Users should be able to copy and paste passwords. Password managers allow users to create and store complex passwords. Users enter one password into the password manager to access stored passwords. They can then copy passwords from the password manager and paste passwords into the password text box. When copy and paste is restricted, users must retype the password and typically default to easier passwords.
Users should be able to use all characters. Password storage mechanisms have commonly rejected spaces and some special characters. By allowing spaces, users can create longer passwords that are easier to remember. Systems sometimes reject special characters to prevent attacks (such as a SQL injection attack), but properly hashing the password masks these characters.
Password length should be at least eight characters and as many as 64 characters. A longer length allows users to create passphrases that are meaningful to them.
Password systems should screen passwords. Before accepting a password, password systems should check them against a list of commonly used passwords, such as 123456 or password.
2.3.1.2 PCI DSS Password Requirements
The PCI DSS (version 3.2.1) has the following requirements, which differ from NIST SP 800-63B:
Passwords expire at least every 90 days.
Passwords must be at least seven characters long.
2.3.2 Something You Have
Smartcards and hardware tokens are both examples of the Type 2, or something you have, factor of authentication. They are rarely used by themselves but are commonly combined with another authentication factor, providing multifactor authentication.
Smartcards
A smartcard is a credit card–sized ID or badge and has an integrated circuit chip embedded in it. Smartcards contain information about the authorized user that is used for identification and/or authentication purposes. Most current smartcards include a microprocessor and one or more certificates. The certificates are used for asymmetric cryptography such as encrypting data or digitally signing emails.
Users insert the card into a smartcard reader when authenticating.
Tokens
A token device, or hardware token, is a password-generating device that users can carry with them. Tokens are typically combined with another authentication mechanism. For example, users might enter a username and password (in the something you know factor of authentication) and then enter the number displayed in the token (in the something you have factor of authentication). This provides multifactor authentication.
Hardware token devices use dynamic onetime passwords, making them more secure than static passwords. These are typically six or eight PINs.
Time-Based One-Time Passwords Time-based one-time passwords (TOTPs) are generated by devices and applications that are synchronized with an authentication server. They generate a new OTP periodically, such as every 60 seconds. This requires the authenticator and the server to have accurate and synchronized clocks. For this reason, TOTP approaches are also known as synchronous authenticators.
Hash-Based One-Time Passwords HMAC-based one-time passwords (HOTP) do not use a clock. Instead, the hardware authenticator generates OTPs based on an algorithm and an incrementing counter. When using an incrementing counter, the user clicks a button, causing the authenticator to create a dynamic one-time password that stays the same until it is used for authentication. For this reason, HOTP approaches are also known as asynchronous authenticators.
2.3.3 Something You Are
Another common authentication and identification technique is the use of biometrics. Biometric factors fall into the Type 3.
Fingerprints Fingerprints are the visible patterns on the fingers and thumbs of people. Fingerprints have loops, whorls, ridges, and bifurcations (also called minutiae) and fingerprint readers match the minutiae to data within a database. Отпечатки пальцев имеют петли, завитки, гребни и раздвоения (также называемые мелочами), а считыватели отпечатков пальцев сопоставляют мелочи с данными в базе данных.
Face Scans Face scans use the geometric patterns of faces for detection and recognition.
Retina Scans Retina scans focus on the pattern of blood vessels at the back of the eye.
Iris Scans Focusing on the colored area around the pupil, iris scans are the second-most accurate form of biometric authentication.
Palm Scans Palm scanners scan the palm of the hand for identification.
Voice Pattern Recognition This type of biometric authentication relies on the characteristics of a person’s speaking voice, known as a voiceprint.
Biometric Registration. For a biometric device to work as an identification or authentication mechanism, enrollment (or registration) must occur. During enrollment, a subject’s biometric factor is sampled and stored in the device’s database. This stored sample of a biometric factor is the reference profile (also known as a reference template).
The throughput rate is the amount of time the system requires to scan a subject and approve or deny access
2.3.3 Something You Are
Biometric Factor Error Ratings
False Rejection Rate A false rejection occurs when an authentication system does not authenticate a valid user. This is sometimes called a false negative authentication. The ratio of false rejections to valid authentications is known as the false rejection rate (FRR). False rejection is sometimes called a Type I error.
False Acceptance Rate A false acceptance occurs when an authentication system authenticates someone incorrectly. This is also known as a false positive authentication. The ratio of false positives to valid authentications is the false acceptance rate (FAR). False acceptance is sometimes called a Type II error.
Most biometric devices have a sensitivity adjustment. When a biometric device is too sensitive, false rejections (false negatives) are more common. When a biometric device is not sensitive enough, false acceptance (false positives) are more common.
The overall quality of biometric devices with the crossover error rate (CER), also known as the equal error rate (ERR). The point where the FRR and FAR percentages are equal is the CER, and the CER is used as a standard assessment value to compare the accuracy of different biometric devices. Devices with lower CERs are more accurate than devices with higher CERs.
