Security Plus - Chapter 8 Flashcards
Identity
The sets of claims made about a subject.
Subject
People, applications, devices, systems, or organizations that require access to something.
Attributes
A broad range of information about a subject:
Name
Age
Location
Job Title
Ways to claim a user’s identity
Username - associated with an identity
Certificate - stored on systems or paired with a storage device to identify systems, devices, or individuals
Token - A physical device that may generate a code, plug in a USB, or connect via Bluetooth to present a certificate.
SSH key - Cryptographic representations of identity that replaces a username and password
Smartcard - An embedded chip either used with a chip reader device or contactless is a cryptographic card with the ability to generate key pairs on the card itself.
Authentication
Verifies that a user is who they claim that they are.
Authorization
Verifies that a user is provided the proper access that is applied to their account. When combined with authentication protocols, this allows a user to access resources, systems, and other objects based on what the user is permitted to access.
Extensible Authentication Protocol (EAP)
An authentication framework that is commonly used for wireless networks. Types of EAP implementations:
EAP-TLS
LEAP
EAP-TTLS
Challenge Handshake Authentication Protocol (CHAP)
An authentication protocol that uses an encrypted challenge and three-way handshake to send credentials. It is designed to provide more security than earlier protocols like PAP.
802.1X
An IEEE standard for network access control (NAC) used for authentication of devices that want to connect to a network. Supplicants send authentication requests to authenticators such as network switches, access points, or wireless controllers, which connect to the authentication server for validation. These authentication servers are typically RADIUS servers which rely on a backend directory, typically LDAP or Active Directory as a source for identity information.
Remote Authentication Dial-In User Service (RADIUS)
Operates via TCP or UDP in a client-server model. It sends passwords that are obfuscated by a shared secret and MD5 hash, which is not rather secure. It is usually encrypted using IPSec tunnels for the internal traffic. IT is one of the most common authentication, authorization, and accounting systems for network devices, wireless networks, and other services.
Terminal Access Controller Access Control System Plus (TACACS+)
A Cisco designed extension that uses TCP traffic to provide authentication, authorization, and accounting services. It provides full-packet encryption as well as granular command controls, allowing individual commands to be secured as needed.
Kerberos
A protocol for authenticating service requests between trusted hosts across an untrusted network like the Internet. It uses authentication to shield the authentication traffic. Kerberos users are composed of three main elements:
Primary - The username
Instance - Differentiates similar primaries
Realms - Consists of groups of users. Realms are separated by Trust boundaries and have distinct Kerberos key distribution centers (KDC’s)
Kerberos Process
A client using Kerberos to access a service, the client requests an authentication ticket, ticket-granting ticket (TGT). An authentication server checks the client’s credentials and responds with the TGT, which is encrypted using the secret key of the ticket-granting service (TGS). When the client wants to use a service, the client sends the TGT to the TGS (which is usually also the KDC) and includes the name of the resource it wants to use. The TGS sends back a valid session key for the service, and the client presents the key to the service to access it.
Single Sign-On
Allowing users to log in to multiple systems by using a single identity without reauthenticating.
Lightweight Directory Access Protocol (LDAP)
An organizational directory of information about the organization. Commonly deployed as part of an identity and access management infrastructure.
Security Assertion Markup Language (SAML)
An XML based open standard for Internet-based systems to exchange authentication and authorization information. Usually used between identity providers and service providers.
Used for Federated authentication purposes.
OpenID
An open standard for decentralized authentication. OpenID identity providers can be leveraged for third-party sites using established identities. Ex. Google logins to Gmail then also provides access to YouTube, Drive, etc.
Used for Federated authentication purposes.
OAuth
An open standard for authorization that ensures users can determine what information to provide to third-party applications and sites without sharing credentials.
Used for authorization of access to protected resources.
Federation
Creates a trusted relationship between organizations and third parties, such as partners or application vendors, so they can share identities and authenticate users across domains.
Identity Providers (IdP)
Manage the lifecycle of digital identities from creation through maintenance to eventual retirement of the identity in the systems and services it supports. Part of the federated identity deployments when paired with relying parties that trust the IdP to handle authentication and then rely on that authentication to grant access to services.
Federation Common Terminology
Principal - The user
Identity Providers - Provides identity and authentication services via an attestation process in which the IdP validates that the user is who they claim to be.
Service Providers - Provides services to users whose identities have been attested to by an identity provider and then perform the requested function.
Attestation - Formal verification that something is true. A user is who they say they are because they have presented an identifier and are authorized by the IdP.
Relying Party - (RP) - Requires authentication and identity claims from an IdP
NIST Password Guidelines
Use a Password Manager
Locking accounts after multiple failed attempts
Employ multi-factor authentication
Emphasize length of password
Allow ASCII and Unicode characters in passwords
Monitor passwords to ensure no common, previously compromised, or obvious word selections (username, company name, etc.) are permitted.
Limit on how often a user can use a previously used password
Expiration dates so there is a required timeframe to update a user’s password
Age settings of a password to ensure a user does not reset their password continually until they get back to their preferred former password.
Passwordless Authentication
Authentication relies on something you have, security tokens, security keys, one-time password authenticator, or certificates, or something you are like biometrics.
Multi-Factor Authentication
A multi-step account login process that requires users to enter more information than just a password. Must contain more than one of the four factors:
Something you know - Password, PIN, or answer to a security question
Something you have - Smartcard, security token, security key, one-time password authenticator
Something you are - Relies on physical characteristics - Fingerprint, retina scan, voice validation, and typing speed or pattern
Somewhere you are - Location factor, based on the current location. GPS, network location, and other data can be used to ensure that users who are in that location can authenticate.
