Identification and Authentication (Lesson 10) Flashcards
3 Methods to Authenticate + 2
3 general methods to authenticate Something you know Something you have Something about you/that you are location dynamic biometrics
Rules for passwords
Don’t pick an easy one to guess
mix upper and lower case, add special characters and numbers
at least 6 characters in length, 8 better, 10 even better
maybe use pass-phrases instead of dictionary words
Don’t write it down
Don’t reuse previous passwords (or just add a # to it)
Change it on a regular basis (but not too often), 45 days.
If you’re the sysadmin, run a password cracker periodically.
If one-time passwords are possible, consider using them (they have their own problems though)
Password management issues
Default accounts Easily guessed or cracked passwords Unpassworded accounts Shared accounts Password aging Password policy enforcement Password auditing Audit frequency Control access to results
One-Time Passwords
User given device that generates a password at certain time intervals (e.g. every minute)
The device is keyed with the server, so that both devices generate the same password at the same time.
If you want to log into the server, look at the display and type in the password you see.
Even if the password is sniffed, it was only good for the minute it was used.
Something you have
Physical keys, magnet cards, smart cards, calculators.
Something about you
Biometrics Voice prints Fingerprint Retinal Scan Hand Geometry Signature analysis
Dynamic Biometrics
captures a dynamic process rather than a static characteristic of a person.
Access Modes Read
allows entity to read the file or view the file’s attributes
List – Access Mode
the entity may view the file’s attributes.
Delete – Access Mode
the entity may remove the file from the system.
Execute – Access Mode
the entity may load the file and run it.
Write – Access Mode
allows the entity to write to the file, which may include creating, modifying, or appending to the file.
Protection Table
Illustrates what access controls are designed to do
File Passwords
In order to gain access to a file the user must present the system with the file’s password.
In order to control the type of access granted to the file, multiple passwords for each file may be necessary.
Capabilities Based Access Controls
Divides the protection table by rows (Object and Permissions columns). Each user has a table.
Associated with each entity is a list of the objects the user may access along with its permissions.
ACL
Access Control List
- Divides protection table by columns.
- Instead of maintaining a separate list for each subject, ACLs are created for each object.
- each row is a user.
- Tables by filename.
Modified ACL
Divide users into groups.
Requires less room.
ACL with access restrictions
ACL with multiple individual user access restrictions based on time and location.
NT Access Control Lists (ACL)
All securable objects are assigned a security descriptor when created.
Descriptor controls who has what access to the object
Consists of
-Owner SID: The owner’s security ID
-Group SID: The security ID fo the primary group.
—Discretionary Access Control List (DACL): specifies who has what access to the object.
—System Access Control List (SACL): Specifies which operations by which users should be logged in the security audit log.
ACE
Access control entry.
The access control list is made up of an ACL header and 0 or more access control entry (ACE) structures. An ACL with 0 ACEs is called a nullACL and indicates that no user has access to the object.
Protection Bits
A modification of ACLs.
Protection bits are attached to each file but instead of providing a complete list of all users they specify permissions for specific classes.
Sometimes referred to as “permission bits”.
Example classes: Owner, Group, World
Discretionary Access Controls
are controls implemented at the discretion or option of the user/owner (e.g. protection bits)
Nondiscretionary Access Controls
are controls that are determined by a central authority in the organization and can be based on the individual’s role or job.
- Role-based Access Controls: tied to the particular role the user performs
- Task-based Access Controls: tied to a particular assignment or responsibility
