- In this lesson 19.3,
we're gonna focus in on authentication.
Let's just start with an access primer.
As a reminder, identification is how a subject
is uniquely recognized.
And we talked about identity proofing earlier on,
as well as having a federated identity
or a portable identity.
Authentication is how an identity is proven to be genuine.
Now, in the physical world,
we might use a driver's license or a passport.
We're going to have to have other ways
to prove our identity, right,
in the technical or logical world.
And then authorization defines
how access rights and permissions are granted,
identification, authentication, and authorization.
Now, authentication, again, is the process
of proving an identity to an authentication system.
You're proving your identity to be genuine.
Now, the proof is referred to as a factor
and a combination of a username or identity, if you will,
and factor is referred to as your credentials.
Now, there are four primary authentication factors,
knowledge, possession, biometric, and location.
Knowledge is something a user knows,
like your password, a passphrase,
a PIN, or an answer to a challenge,
or an out-of-wallet question.
Possession, well, that's something that you have, right?
Could be a token, a smart card,
could even be your cell or mobile phone.
Now, biometric is either something a user is
or something a user does.
Now, something a user is, is referred to physiological
and something a user does
is referred to as a behavioral marker.
And then lastly, we have location,
which is somewhere a user is.
That could be based on GeoIP,
a geofence, latitude or longitude,
or even proximity to a specific device.
So, knowledge, possession, biometric, and location.
So, let's look a little deeper into each one of these
starting with knowledge.
The most common type of knowledge factor
really is just a data string that's created
by a user or a password generator.
Now, we'll refer to that as a password, or if it's long,
sometimes we refer to it as a passphrase or a PIN.
PIN is generally numbers.
But knowledge could also be a cognitive challenge question.
Now, we've all filled these out.
That's when you are presented a set of questions
and you get to choose the questions and the answers
during the enrollment period.
And then later on, if your identity needs to be verified,
you know, the second step there,
you will be presented that challenge question.
And then we have out-of-wallet challenge questions.
Now, these are questions and answers
that are derived from public subscription databases.
Like which of these cars did you own?
Or which of these streets did you live on?
But in all cases, this is based on knowledge.
It's based on something, you know,
whether it's a password, a PIN,
a passphrase, a cognitive challenge question,
or an out-of-wallet challenge question, right?
They're all the same factor.
They're all based on knowledge.
Now, it's interesting in the past year
NIST has put some new password guidelines out there
that I think are very interesting
about length, and what's allowed, and what's disallowed,
and how frequently or infrequently you should reset it.
Should you show your password,
should you permit paste and uniqueness.
And these are all detailed
in NIST Special Publication 800-63 Password Guidelines.
So, let's talk through these.
NIST says that you should use long passwords,
eight to 64 characters,
but to prioritize length over complexity.
That's really interesting.
And this sort of a change in the way
we've approached passwords in the past.
Prioritize length over complexity.
Why? Because it's all about
users being able to remember their passwords,
not writing them down, not putting 'em in a spreadsheet,
not having to constantly have their passwords reset.
So, prioritizing length over complexity.
The suggestion is that all ASCII
and Unicode characters should be allowed
including emojis and spaces.
We should disallow dictionary words.
So, we shouldn't be able to have real regular words
and simple number sequences like 1, 2, 3, 4, 5, 6, 7, 8, 9,
which is an incredibly common password.
And they suggest that we don't
enforce password expiration periods.
Don't make your users change their passwords
every 30 days or every 60 days.
They can keep their passwords, their passwords are fine,
unless there's a suspicion of compromise.
Again, we're really trying to make it easier for our users
so they remember their passwords, right?
They don't have to keep writing them down.
They don't have to keep changing them,
because they forgot them.
Allow show password option so they can see it,
but disallow hints.
So that's interesting.
Allow it to show it so as you're typing it
to show what you're typing,
but not to allow hints, right?
Because hints could be, anybody could see the hints
and then be able to say,
"Oh, I can guess that password."
To remit paste functionality when entering a password.
Now, that's really great,
because if someone's using let's say a password manager
and they wanna copy and paste in the password manager
right into the application.
And that's lastly uniqueness.
That we wanna encourage users to use a unique password.
And absolutely, it is recommended
using a password manager for generation.
So, these are the NIST 800-63 Password Guidelines
and you can read more about them
in the Special Publication 800-63.
Now, there's also a suggestion
that our users should be using password managers
also known as password vaults.
Now, password vaulting is a technology
used to securely store and manage passwords
and other sensitive credentials.
I can't imagine functioning
without a password manager, honestly.
Password vaults store passwords in a secure location.
Accessible only to authorized individuals and systems.
Now, passwords stored in the vault are encrypted
using very robust encryption algorithms.
And access to a password vault or password manager,
is typically protected by strong authentication
such as biometric verification or two-factor authentication,
which we'll be talking about shortly.
Password vaults often provide the capability
to generate strong, complex passwords automatically.
And then the vault will securely
store those generated passwords,
eliminating the need for users to remember them,
which is really awesome.
Let's talk about possession.
And first, we're gonna look at possession
in terms of a one-time password.
Now, a one-time password is either generated
by something you have or sent to something you have.
A time-based, one-time password, or a TOPT,
is a hardware or software token
that generates an one-time password, an OTP,
using a shared secret with an authentication server
and the current time.
Where a hash-based OPT is a hardware or software token
that generates the OPT using a secret key
and a cryptographic hash function.
And then we can have an SMS or a voice-based OPT,
which is a numeric or alpha numeric code
that's sent to a phone number, either via voice or text.
So, in for a time and hash OTP
you have to have the token, right?
And for the SMS or voice,
you have to have that mobile phone.
So, you have to have something in your possession
that, that one-time password is being sent to.
Now, another form of possession
would have be having a smart card.
A smart card is a card or badge
that's in the user's possession
and the smart card will have an embedded chip
and one or more certificates.
Very often smart cards are also used as our ID badges
for building access and for network authentication,
we're using 'em for both.
Now, a contactless smart card
has a one inch to three inch range
and a proximity smart card has a one inch to 15 inch range.
Implementation of smart cards
require a smart card management system,
which includes customization, issuance,
revocation and replacement.
Then we come to biometrics.
Now, biometrics are physical
or behavioral human characteristics
that can be used to digitally identify a person.
Biometric options are physiological markers, what you are,
or behavioral traits, which is what you do.
Now, we're gonna be talking
all about biometrics in our next lesson.
So, let's talk about factor requirements.
Our options for factor requirements
are single factor, multi-layer, multi-factor,
also referred to as 2FA and two-step verification.
Single factor says only one factor
is required for authentication.
And sadly, that's still really
probably the most popular factor.
One factor and it's all generally gonna be
just your password.
Multi-layer is two or more
of the same type of factor required for authentication.
So, if I have to put in a password and PIN,
those are both something I know, right?
That would be multi-layer.
If I have to put in a password
and answer a challenge question,
either a cognitive or out of wallet,
they're both something I know, right?
So, that would be multi-layer.
So, two or more of the same type of factor
is called multi-layer.
Multi-factor is when I have two or more different types
of factors required for authentication.
So, if I have to put in a password
and I have to also maybe use my thumb
to, you know, or a finger to log in
that would be something I know and something I am, right?
If I have to have, if I know a code
plus I have to put in the a
add that to the code of that comes from my token, right?
That would be something I have, my token,
plus something I know, right?
My personal code.
So, two or more different types
of factors required for authentication.
And then two-step verification,
just confirms a user's identity by requiring a response.
So, an example of a second step
would be a user repeating back a code
that got sent to a mobile number or an email address.
So, single-factor, multi-layer,
multi-factor and two-step verification.
Now, you may start hearing the term passwordless.
Passwordless refers to a method of authentication
that eliminates the need for traditional passwords
as the primary means of verifying a user identity.
So, instead of relying on passwords,
passwordless authentication relies on alternate methods
or factors to authenticate users.
So, how do you decide, right,
how many factors you should have?
The type of factors, you know,
how do you make these decisions?
Well, decisions regarding the type and the number of factors
should always, always, always, always, always, always,
be commensurate with the business value
of what's being protected, your regulatory requirements,
and your contractual obligations.
In other words, strategically aligned with the organization.
That my friends brings us to a three-second challenge.
Five challenge questions, three seconds each.
You know how to do it.
Question one, this type of challenge question
uses a preselected question and answer.
One, two, three.
That is a cognitive challenge question.
Number two, the use of two or more
different factors for authentication.
Two or more different factors for authentication.
One, two, three.
That's multifactor, also referred to as 2FA.
Number three, the combination of username and factors.
What do we refer to that as?
A combination of a username and their factors.
One, two, three.
That's gonna be credentials.
Number four, a hardware or software token
that generates an OTP, a one-time password,
using a secret shared with authentication server
and the current time.
This is an easy one.
One, two, three.
What do you got?
That's a time OTP,
'cause it's using the current time.
Number five, GeoIP is an example
of this authentication factor.
One, two, three.
And that's gonna be location.
So, that brings us to a security and actions
we can apply our knowledge.
And this one's about Gmail authentication.
You are designing an internal seminar
on personal cybersecurity best practices.
So, what people should do at home,
what they should share with their families.
One of your topics is the importance
of strong email authentication
and you're planning on demonstrating
Google's Gmail authentication process.
Now, whenever you sign into Gmail,
you'll enter your password as usual,
and a one-time code will be sent to your phone via text,
a voice call, or a mobile app,
and a reply must be sent with that code.
So, what terminology should you use
to describe this process?
Go ahead and put me on pause, jot down some notes.
Well, this is an example
of multifactor, two-step verification.
Multiple factors are something you know,
in this case, password, and something you have,
because you have to have your phone, right?
You need to know your password and your phone.
Now, two-step verification confirms a user's identity
by requiring a response.
Step one, the user signs in with their password.
Step two, the Google authentication server
responds by sending a one-time code to the user's phone
and the user responds by sending the code
back to the authentication server.
We should always, always be training our user community
to really lock down and secure their email, right?
If our adversaries can get into our email,
well, they can cause all kinds of crazy havoc.
So, teaching them this and being able to explain it,
definitely security in action.
Big word cloud, you know what to do.
Make sure that you understand, right, all of these terms
and all of these concepts before you move on.
If not, go on back through the lesson
and then when you're ready, come to the next lesson
and I'll be waiting for you right there.