Summarize authentication and authorization design concepts Flashcards
Authentication methods
Directory services Federation Attestation Technologies Smart card authentication
Directory services
What is directory services in cyber security?
Directory services are software systems that store, organize and provide access to directory information in order to unify network resources. Directory services map the network names of network resources to network addresses and define a naming structure for networks.
Federation
A collection of realms (domains) that have established trust among themselves. The level of trust may vary, but typically includes authentication and may include authorization.
Attestation
Attestation is a mechanism for software to prove its identity. The goal of attestation is to prove to a remote party that your operating system and application software are intact and trustworthy.
Technologies
Time-based onetime password (TOTP) HMAC-based one-time password (HOTP) Short message service (SMS) Token key Static codes Authentication applications Push notifications Phone call
Time-based onetime password (TOTP)
Its a temporary password
HMAC-based one-time password (HOTP)
Put in layman’s terms, HMAC-based One-time Password algorithm (HOTP) is an event-based OTP where the moving factor in each code is based on a counter. Each time the HOTP is requested and validated, the moving factor is incremented based on a counter.
An algorithm that generates a one-time password using a hash-based authentication code to verify the authenticity of the message.
Short message service (SMS)
Texting the temporary password
Token key
A physical or virtual item that contains authentication and/or authorization data, commonly used in multifactor authentication.
Static codes
There are also simpler token keys and smart cards that simply transmit a static token programmed into the device. For example, many building entry systems work on the basis of static codes. These mechanisms are highly vulnerable to cloning and replay attacks.
Authentication applications
Authentication applications are downloaded to your device and generate secure, six-digit codes you use to sign in to your accounts. … Download and install an authentication app to your device. Some popular options include: Android options: Google Authenticator, Authy, LastPass, 1Password.
Push notifications
Push Notification Authentication enables user authentication by sending a push notification directly to a secure application on the user’s device, alerting them that an authentication attempt is taking place. Users can view authentication details and approve or deny access, typically via a simple press of a button.
Phone call
the code is delivered as an automated voice call to the registered phone number.
Smart card authentication
means programming cryptographic information onto a card equipped with a secure processing chip. The chip stores the user’s digital certificate, the private key associated with the certificate, and a personal identification number (PIN) used to activate the card.
Biometrics
Fingerprint Retina Iris Facial Voice Vein Gait analysis Efficacy rates False acceptance False rejection Crossover error rate
