1 / 29

Identification and Authentication: Essentials and Best Practices

Learn about identification and authentication methods, including passwords, biometrics, and one-time passwords. Understand the vulnerabilities of passwords and how to protect against password attacks. Explore smart cards and biometrics for enhanced security measures.

jessieh
Download Presentation

Identification and Authentication: Essentials and Best Practices

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. CSCE 201Identification and Authentication Fall 2015

  2. Required reading list: • An Introduction to Computer Security: The NIST Handbook, http://csrc.nist.gov/publications/nistpubs/800-12/handbook.pdf : Chapter 16, IDENTIFICATION AND AUTHENTICATION, pages 180-192 • Recommended: • Biometrics, from Wikipedia, the free encyclopedia, http://en.wikipedia.org/wiki/Biometrics • John the Ripper password cracker http://www.openwall.com/john/ • Brutus the remote password cracker http://www.hoobie.net/brutus/

  3. Identification • Something you know • Something you own • Who you are • What you are • Where you are

  4. Identification • Allows an entity (a user or a system) to prove its identity to another entity • Typically, the entity whose identity is verified reveals knowledge of some secret S to the verifier • Strong authentication: the entity reveals knowledge of S to the verifier without revealing S to the verifier

  5. Identification Information Must be securely maintained by the system.

  6. Authentication • Authentication mechanism: verifies the identification information • Access control mechanism: grant privileges upon successful authentication • Logging: record security relevant events in an audit trail

  7. Authentication Requirements • Network must ensure • Data exchange is established with addressed peer entity not with an entity that masquerades or replays previous messages • Network must ensure data source is the one claimed

  8. Passwords • Commonly used method • For each user, system stores (user name, F(password)), where F is some transformation (e.g., one-way hash) in a password file • F(password) is easy to compute • From F(password), password is difficult to compute • Password is not stored in the system • When user enters the password, system computes F(password); match provides proof of identity

  9. Vulnerabilities of Passwords • Inherent vulnerabilities • Easy to guess or snoop • No control on sharing • Practical vulnerabilities • Visible if unencrypted in distributed and network environment • Susceptible for replay attacks if encrypted naively • Password advantage • Easy to modify compromised password.

  10. Attacks on Password • Guessing attack/dictionary attack • Social Engineering • Sniffing • Trojan login • Van Eck sniffing

  11. Social Engineering • Attacker asks for password by masquerading as somebody else (not necessarily an authenticated user) • May be difficult to detect • Protection against social engineering: strict security policy and users’ education

  12. Password Management Policy • Educate users to make better choices • Define rules for good password selection and ask users to follow them • Ask or force users to change their password periodically • Actively attempt to break user’s passwords and force users to change broken ones • Screen password choices

  13. One-time Password Use the password exactly once!

  14. Time Synchronized • There is a hand-held authenticator • It contains an internal clock, a secret key, and a display • Display outputs a function of the current time and the key • It changes about once per minute • User supplies the user id and the display value • Host uses the secret key, the function and its clock to calculate the expected output • Login is valid if the values match

  15. Time Synchronized Secret key Time Encryption One Time Password

  16. Challenge Response • Non-repeating challenges from the host is used • The device requires a keypad Network Work station Host User ID Challenge Response

  17. Challenge Response Secret key Challenge Encryption One Time Password

  18. Devices with Personal Identification Number (PIN) • Devices are subject to theft, some devices require PIN (something the user knows) • PIN is used by the device to authenticate the user • Problems with challenge/response schemes • Key database is extremely sensitive • This can be avoided if public key algorithms are used

  19. Smart Cards • Portable devices with a CPU, I/O ports, and some nonvolatile memory • Can carry out computation required by public key algorithms and transmit directly to the host • Some use biometrics data about the user instead of the PIN

  20. Biometrics • Fingerprint • Retina scan • Voice pattern • Signature • Typing style

  21. Problems with Biometrics • Expensive • Retina scan (min. cost) about $ 2,200 • Voice (min. cost) about $ 1,500 • Signature (min. cost) about $ 1,000 • False readings • Retina scan 1/10,000,000+ • Signature 1/50 • Fingerprint 1/500 • Can’t be modified when compromised

  22. Home Computer Security

  23. Problem: You don’t remember your password Solutions: • Verify that you have typed the letters of your password in the correct case • Access a password hint on the Welcome screen • Use a password reset disk • Log on as administrator to assign a new password to your account

  24. Password Case Sensitivity • Check CAPS LOCK key Question: Why do you want to use combination of symbols for your password?

  25. Using the Password Reset Disk • Create a password reset disk for your user account at the earliest opportunity • How to use the password reset disk • Microsoft Windows remembers if you have created a password reset disk. Just click use your password reset disk • Follow the instructions of the Password Reset Wizard Question: Why should you safeguard your password reset disk?

  26. Use a Password Hint • Create a password hint: • Log on to your computer • Click Start, and then click Control Panel • Double-click User Accounts • Click your user account, and then click Change my password • Enter your current password, enter a new password, and then enter the new password again to confirm it • Enter the password hint, and then click Change Password • The change will take effect the next time that you log on • To display the hint, click the question mark (?) that is next to your user account

  27. Create a Password Reset Disk • Click Start, and then click Control Panel • Double-click User Accounts • Click your user account, and then click Prevent a forgotten password. The Forgotten Password Wizard starts • Follow the instructions • NOTE: A password reset disk is valid until you create a new one; even if you change your password

  28. Next Class • Cyber stalking, Fraud and Abuse

More Related