- [Tutor] Identification is the process
of providing the identity of a subject or user.
This is the first step in authentication authorization
and accounting processes.
Providing a username, a passport, an IP address,
or even pronouncing your name is a form of identification.
A secure identity should be unique
in the sense that two users should be able
to identify themselves unambiguously.
This is particularly important
in the context of account monitoring.
Duplication of identity is possible
if the authentication systems are not connected.
For example, a user can use the same user ID
for his corporate account,
and for his personal email account.
A secure identity should also be non-descriptive,
so that information about the user's identity
cannot be inferred.
For example, using administrator as the user ID
is generally not recommended.
An identity should also be issued in a secure way.
This includes all processes and steps
in requesting and approving an identity request.
This property is usually referred to as secure issuance.
There are three categories of factors
used in authentication;
knowledge, which is something the user knows,
possession, which is something a user has,
and inheritance or characteristics,
which is something the user is.
Authentication by knowledge
is where the user provides a secret
that is only known by him or her.
An example of authentication by knowledge
would be a user providing a password
or a personal identification number,
or answering security questions.
The disadvantage of using this method
is that once the information is lost or stolen,
for example, if a user's password is stolen,
an attacker would be able to successfully authenticate.
Nowadays, a day does not pass
without hearing about a new breach in retailers,
service providers, cloud services,
and other social media companies.
Take a look at the various community database.
There you'll see hundreds of breach cases
where users' passwords were exposed.
Websites like "Have I Been Pwned"
include a database of billions of usernames and passwords
from past breaches, and even allow you to search
for your email address to see if your account
or information has been potentially been exposed.
Something you know is knowledge-based authentication.
It could be a string of characters
referred to as a password or pin,
or it could be an answer to a question.
Passwords are the most commonly used
single factor network authentication method.
The authentication strength of a password
is a function of its length,
complexity, and unpredictability.
If it is easy to guess or deconstruct,
it is vulnerable to attack.
Once known, it is no longer useful as a verification tool.
The challenge is to get users to create, keep secret,
and remember secure passwords.
Weak passwords can be discovered within minutes
or even seconds using any number
of publicly available passwords crackers,
or social engineering techniques.
Best practices dictate
that passwords be a minimum of eight characters in length,
include a combination of at least three
of the following characters;
uppercase and lowercase letters,
punctuation, symbols, and numerals,
as well as changing frequently and being unique.
Using the same password
to log into multiple applications and sites
significantly increases the risk of exposure.
In NIST special publication, 800-63B,
digital identity guidelines,
authentication and lifecycle management provides guidelines
for authentication and password strength.
NIST confirms that the length of a password
has been found to be a primary factor
in characterizing password strength.
The longer the password, the better.
Passwords that are too short are very susceptible
to brute force and dictionary attacks,
using words and commonly chosen passwords.
NIST suggests that the minimum password length
that should be required depends to a large extent
on the threat model being addressed.
Online attacks where the attacker attempts to log in
by guessing the password can be mitigated
by limiting the rate of login attempts per minute.
When talking about authentication
by ownership or possession, this type of authentication
is where the user is asked to provide proof
that he owns something.
For example, a system might require an employee
to use a badge to access a facility.
Another example of an authentication by ownership
is the use of a token or smart card.
Similar to the previous method,
if an attacker is able to steal the object
used for authentication,
he will be able to successfully access the system.
Examples of authentication by ownership or possession
include the following; one time password,
memory cards, smart card, and out of band communication.
The most common of the four is the one time password
sent to a device in the user's possession.
A one time password or OTP is a set of characteristics
that can be used to prove a subject's identity one time,
and only one time.
Because the OTP is valid for only one access, if captured,
additional access would be automatically denied.
OTPs are generally delivered
through hardware or software token.
The token displays the code
which must then be typed in at the authentication screen.
Alternatively, the OTP may be delivered via email,
text message, or phone call
to a predetermined address or phone number.
A memory card is an authentication method
that holds user information within a magnetic strip,
and relies on a reader to process the information.
The user inserts the card into the reader
and enters a specific personal identification number.
Generally, the pin is hashed and stored
on the magnetic strip.
The reader hashes the inputted pin
and compares it to the value on the card itself.
A familiar example of this is a bank ATM card.
A smart card works in a similar fashion.
Instead of a magnetic strip,
it has a microprocessor and integrated circuits.
The user inserts the card into a reader,
which has electrical contacts that interface with the card
and power the processor.
The user enters a pin that unlocks the information.
The card can hold the user's private key, generate an OTP,
or respond to a channel's response.
Out of band authentication requires communication
over a channel that is distinct from the first factor.
A cellular network is commonly used
for out of band authentication.
For example, the user enters her name and password
at an application login prompt, which is factor one.
The user then receives a call on her mobile phone.
The user answers and provides the predetermined code,
which is factor two.
For the authentication to be compromised,
the attacker would have to have access
to both the computer and the phone.
A system that uses authentication by characteristic
authenticates the user
based on some physical or behavioral characteristic,
sometimes referred to as biometric attributes.
The most used physical or physiological characteristics
are as follows; fingerprints, face recognition,
retina or iris, palm and hand geometry,
blood and vascular information,
as well as voice recognition.
Other examples of behavioral characteristics
are signature dynamic, key stroke dynamic/pattern.
The drawback of a system
based on this type of authentication
is that it is prone to accuracy errors.
For example, a signature dynamic based system
would authenticate a user by requesting
that the user write his signature,
and then compare the signature pattern
to a record in the system.
Given that the way a person signs his name
differs slightly every time, the system should be designed
so that the user can still authenticate
even if the signature and pattern
is not exactly the one in the system.
However, it should also not be too loose
and unintentionally authenticate an unauthorized user
attempting to mimic the pattern.
Two types of errors are associated
with the accuracy of biometric systems.
A type one error, also called false rejection,
happens when the system rejects a valid user
who should have been authenticated.
A type two error, also called false acceptance,
happens when the system accepts a user
who should have been rejected.
For example, an attacker trying to impersonate a valid user.
The crossover error rate, or CER,
also called the equal error rate, or EER,
is the point where the rate of false rejection errors or FRR
and the rate of false acceptance error, FAR, are equal.
This is generally accepted as an indicator
of the accuracy of biometric systems.
In multifactor authentication, the process of authentication
requires the subject to supply verifiable credentials.
The credentials are often referred to as factors.
Single factor authentication
is when one factor is presented.
The most common method of single factor authentication
is the use of passwords.
Multifactor authentication
is when two or more factors are presented.
Multilayer authentication is when two or more
of the same type of factors are presented.
Data classification, regulatory requirements,
the impact of unauthorized access,
and the likelihood of a threat being exercised
should all be considered when you're deciding
on the level of authentication required.
The more factors,
the more robust the authentication process.
Identification and authentication
are often performed together.
However, it is important to understand
that they are two different operations.
Identification is about establishing who you are,
whereas authentication is about proving
you are the entity you claim to be.
In response to password insecurity, many organizations
have deployed multifactor authentication options
to their users.
With multifactor authentication,
accounts are protected by something you know,
something you have.
Even gamers have been protecting their accounts
using MFA for years.