Okay, identity and access management.
Identity and access management is responsible for providing the right
individual with the right access at the right time.
So it involves identity creation, privilege assignments, and so forth.
It involves authentication, authorization, the management of the identity over its
life cycle, the storing of the identity in a repository.
The identity repository may be something like a directory service.
It may be a third party provider.
It may be provided by a third party
organization, single sign ons, federated identities, and that thing.
The identity defined is a set of
attributes linked to an entity that can be stored and authenticated digitally.
So for example, my user account, Eric, has
different attributes, passwords, and group memberships, and so forth.
That user identity is typically verified through an authentication.
And again, that leads to authorization, and that leads to accounting.
Again, we're going to talk about those
different types of authentication here shortly.
All right, identity.
Identities that can help in identity management, and identity provider.
A lot of as a service stuff these days, is
we're going to have a third party actually do it for us.
We're going to pay them to do it.
An identity provider, a service that can
store, manage, and verify digital identities of an individual.
That may be something that's again a third party.
It may be a product used internally, it
may be active directory, something along those lines.
Attributes or any characteristics or
features that define who the user is or the type of user.
A digital certificate, we talked about those briefly in the first chapter.
We're going to talk about those again a little bit little bit later on.
A digitally signed statement with a public key and the subject name on it.
Now, digital certificates are used for a variety of purposes.
The original purpose of a digital
certificate was to bind the public key to the identity of the owner.
When we talk about authentication, we'll
revisit when we talk about asymmetric cryptography and how that might work.
But a digital certificate is like having your driver's license.
It needs to be issued by an entity that we've chosen to trust.
Tokens.
I have a secured system used to transfer authentication information between two
entities through a compact and self contained approach.
Got a couple of different examples of tokens.
We'll look at that as an example of something I have.
They could also be logical access tokens, session identifiers, and that thing.
Ssh keys for secure shell connections.
A private and public key used to authenticate a client to an SSH server.
Believe me, we're going to talk about that.
Then smart cards are little computers, really.
They store the public key in a pin, acts
as a secret key used to authenticate the user.
This is also an example of something I have in my possession.
If you're in the military, your cat card
is one of the best examples on planet Earth of a smart card.
I guess my credit card is a pretty good example of that though too.
Anything with a gold contact pattern qualifies as a smart card.
But as far as access control goes, cat cards in the military.
User identity management.
Identity management in general would be...
Wait a minute, the management of the identity?
Yeah, so the creation, the management, the deactivvation, the provisioning, the
deactivvation are a method to ensure that an individual holds a valid identity.
Examples include attributes, username, account number, and so forth,
involves storing and managing user attributes in their repositories.
Probably the most widely used on planet
Earth these days is active directory on Windows servers.
The Identity Repository, the database where the attributes related users'
identities are stored, and again, a N TDSD IT file or Windows Active Directory
database, probably one of your best examples.
User Access Management or AM for short process of identifying, monitoring, and
regulating authorized users access to an IT system application resource.
It is definitely a good idea to track who does what and track it meticulously.
That way you can investigate security
violations, performance issues and so forth.
But that's one of the coolest things about
digital access is we can record everything you request and everything you do.
It includes all the policies and processes
and tools required for maintenance of the AM with the IT infrastructure,
creates and controls users, roles, groups and policies, and monitors and ensures all
the defined roles and policies are followed.
Fantastic.
Examples.
You use your authentication.
Authentication, and I've mentioned this
before, we're going to mention it again, involves validating the identity of an
individual with a system, application, or network.
So, halt. Who goes here?
I am Eric.
Well, anybody can say they're Eric. Authenticate, Eric.
Authenticate Eric, prove it.
Something I know is something I have, something I am.
We're going to talk about that here in just a second.
So a password, for example. Something I know.
All right, good enough.
That's Eric's secret password.
But also one of the weakest forms of
authentication. All right, so the factors of authentication.
Something I know or type 1, also known as a knowledge factor.
A PIN password and your username actually is a factor.
Username, whoever knows I'm Eric.
Yeah, but your username should also be secret.
It shouldn't be your email address, which
everybody uses because it's globally unique and it's never in use.
But your username should be as secretive
as your password, which in more cases than not, it's not.
But that means now the attacker has to get
your password, they're going to figure out what your username is as well.
So two factors.
Something you have
also known as owner factor or hard tokens, something you have in your possession,
employee ID cards, hardware tokens, USB drives with keys, etc.
Cell phone for SMS second factor authentication.
Then something I am, that is biometrics,
measurement of a physical characteristic or measurement of an activity.
For example, gait analysis or signature dynamics.
Those are the three factors.
A combination of one or more is called
strong authentication or multifactor authentication.
Attributes can be additional conditions
that can be factored in, no pun intended, that can
be taken into consideration for your access attempt as well.
Somewhere that you are,
something that you do, something you exhibit, or someone you know.
Somewhere you are, location based authentication, users physical location.
That could be based on IP address or even GPS coordinates.
Something you do, also known as behavioral characteristics.
Authentication based on actions such as gesture or touch inputs.
That swipe to that pin pattern that you do on your phone where you have to connect
the dots, that might be an example of something you do as well.
Something you exhibit, behavioral based,
authentication, exhibiting some device or thing.
Then someone you know could be reliant on
a web of trust models, so somebody can validate or vouch for you.
Can't give you a really good example of that, but peer based trust models,
one of your best examples of that historically was PGP.
Types of authentication, password authentication.
Flimsy as foreign we have, but most widely used.
Password authentication uses a combination
of a username and a password to authenticate users to the network.
There we go. Maybe a little out of order.
Password is checked against database.
Do we know what the password is?
Usually not.
It's the database that contains the
password hash, which is an encrypted version of the password, but the password
we type in gets transformed into a hash for matching.
When we talked about the birthday attack earlier, if I type in something that just
happens to produce the same hash, the system authenticates me.
Kind of scary but true.
Password authentication can be vulnerable to password cracking attacks.
We've already talked about some examples of password cracking.
Two factor authentication.
Anything that involves more than one factor.
Typically, something I have, something I know, something I am, etc.
We know that something you are is one of the best companions of two
factor authentication since it's the measurement of a physical characteristic.
Something in my possession could be stolen
and somebody could guess my password, but somebody is probably not likely to steal
my thumb for fingerprint based authentication.
Of course, we've seen all the movies where
they chop off the guy's thumb and replay it.
But there are ways to attack this, jelly fingers and imprints and so forth, but
generally speaking, it's much tougher to steal a physical attribute.
Couple of examples of two factor authentication.
Tokens.
Remember these guys, the old RSA secure ID tokens.
Hardware tokens, a dongle,
key fob, built in token authentication factor, rotated every 30 seconds.
Software tokens are installed on your phone, for example.
They may have a time sequence based counter or challenge input, which we're
going to differentiate between those here in just a second.
Two factor authentication techniques.
Open authentication uses a couple of different flavors of sequential increment
encounters or time based authentication, but it's based on...
The main goal is to provide safe and
secure online transactions for users based on two factor authentication.
It's introduced three algorithms which are
HOTP, HMAC based one time password, O CRA, which I can never remember the acronym
for, OAuth challenge response mechanism, and then time based or TOTP.
In a nutshell, you've got a secret component, you've got a variable, and you
got an algorithm, and then that produces the one time password.
This moving factor is your variable, this
is a constant, and then the algorithm is a constant.
In a HMAC based one time password, you
might have a counter, for example, that increments by one.
It's only used once, the next time it increments, you generate and so forth, and
you got a sequentially incrementing counter.
In O CRA, you have a challenge versus a sequentially incrementing counter.
The moving factor is it could be a counter, but it's entered as a challenge.
And at a time based one time password, the moving factor is the time of day.
So the clock synchronization of the device and the server is important.
And sometimes those things would fall out
of sequence and it would go forward 30 seconds or backward 30 seconds and check a
couple of time skews just to see if it got out of alignment.
Biometric authentication, fingerprint
scanning, iris, retinal vein structure and more.
Most are familiar with fingerprint based scanning.
Most mobile devices these days have fingerprint based recognition.
The iris scanning is the colored portion
of your eye, which is very reliable, very accurate.
Retinal scanning analyzes the layer of blood vessels on the back of your eye.
That actually can be subject to errors
based on pregnancy or diabetes, which both have an impact on your blood pressure,
which can actually alter your blood vessels.
Vain structure recognition, thickness and
location of veins, bone density scanners, etc.
Lots of different physical characteristics
that can be examined for biometric authentication.
Our face recognition, voice recognition, gait analysis.
I haven't seen this one firsthand here,
but uses patterns of locomotion, exhibit by moving limbs while walking or
running, and your gait has a unique signature to it.
Some performance metrics of biometric systems.
We're not going to pick each one of these apart, but the efficacy rates or the
effectiveness are things like reliability, throughput.
Imagine you're clocking shift workers into a factory using biometrics, the throughput
rate is pretty important and you also want it to be pretty accurate.
So false acceptance and false rejection rates are two
different metrics that determine the accuracy of the system.
False acceptance is when you are incorrectly authenticated.
Fault alse rejection is where you're incorrectly denied.
So false acceptance has definite security concerns.
False rejection also does due to the fact
that you've got basically a denial service.
The crossover error rates
is the point at which the number of Type 1s, which are false acceptance,
meet the number of Type 2s, which are false rejections.
The lower that CR value, the more accurate the system is said to be.
Matching speed, time taken off indicated individual, failure to capture.
When you enroll in a biometric system, you
present the physical characteristic multiple times.
For example, thumbprint, thumbprint, thumbprint, thumbprint.
You get the little circle that's going click, click, click, click, click.
That enrollment process creates an aggregation or averaging of those inputs
to provide a user profile or template to match subsequent login attempts against.
The failure to capture, failure to enroll
would be the number of failures when initially adding...
Initially adding, I guess, that works,
when you initially add a user to the system.
Again, throughput is the rate at which we
can authenticate, especially important in physical access time, clock
based authentication, factory shift workers, that thing.
Smart card authentication.
Smart card is a small computer chip, holds
the user's personal information required to authenticate them.
They need to insert their smart cards into a reader.
There's a PIN, which is a something I know factor.
The smart card then actually verifies user's identity.
It's a cryptography based authentication,
provides stronger security than password authentication, and it uses asymmetric
keys, which we're going to talk about a little bit later in the course.
But in a nutshell, the public key is used
to encrypt the challenge that is decrypted by the private key.
And we'll talk a little bit more about things called like zero knowledge proof,
which are different ways to use asymmetric encryption.
And we will definitely talk about digital signatures and hybrid encryption.
Single sign on authentication.
The advantage to single sign on is I log in once, I get access to everything.
The disadvantage to single sign in is I log on once, I get access to everything.
It's very convenient, but also the keys to the kingdom type of
connot where that might be considered dangerous.
If I was to steal your single set of
credentials, I have access to everything you have access to.
That raises some security concerns, but the convenience factors one out here
is we see a lot of single sign on solutions.
There's advantages and disadvantages.
It can be implemented through different technologies.
We'll talk a little bit more about those a little bit later in the course.
User access management authorization.
Okay, authorization is controlling the access of information for the individual.
Again, once I've identified, I am Eric,
and authenticated, I've proved it, right?
Now I try to access something and it determines, am I authorized?
If I'm not authorized, what do you mean?
I'm Eric and I just proved my identity.
Yeah, but you don't get access to anything, Eric.
Sorry.
I verified your identity, but according to this, you don't get access to anything.
What's up with that?
Or I'm authorized to access specific resources.
Again, we're just identifying the user here.
Whether I get access to resources is completely at the discretion of the owner
or through some mandatory rule based or rule based access control.
While we've got the whiteboard up, that
also leads to accounting and accountability.
There's an auditing component that's wrapped in there as well.
You can see before or after, but auditing
is recording my actions, which gives me accountability.
And auditing and accounting are sometimes used interchangeably.
All right, types of authorization systems.
If it's centralized, I am maintaining a single database for authorizing the
networks, a resource for applications, easy and inexpensive.
If it's decentralized, each network
resource maintains its authorization unit and performs authorization locally.
So in a decentralized model, it might be a work group or peer to peer model.
In a centralized model, it might be a
domain or client server model if you're talking Microsoft Lingo.
Implicit or explicit.
The implicit is implied, explicit is explicitly assigned.
Unless I explicitly authorize your implicit permissions apply.
Typically, and this is a twofold
discussion, your implicit permission is something that's not configured.
It's a given, it's assumed.
You should always have an implicit deny on everything.
Unless stated otherwise, you are not
allowed to access to anything unless I explicitly allow it.
Best case security scenario.
If you have an implicit allow and explicit deny, we'll call that blacklisting.
If you have an implicit deny and
explicit allow, I'll think about that for a second, we'll call that whitelisting.
We'll see a couple of different configurations or context for this.
But in the implicit authorization, users
can access the requested resource on behalf of others.
The request to access goes to a primary resource to access the requested resource.
In explicit, each authorization requires a
separate authorization for each requested resource.
An explicit maintains the authorization for each requested object.
You see implicit explicit used in
different contexts three or four different ways by the time the courses...
By the end of the course.
Here we go. Accounting.
Accounting is a method of keeping track of user actions on the network.
It's also auditing, keeps track of who, when, and how the users access the
network, helps in identifying authorized and unauthorized actions.
It can be used for trend analysis, data
breach detection, forensic investigations, etc.
That is logging.
Your account types.
Account types are privileged or
nonprivileged or a guest account, which is even less privileged than a nonprivileged.
But a user account runs with least privileges permissions,
running applications, programs, creating and manipulating files.
Your average user is a user account.
Guest accounts have even less privilege,
don't have any privileges to modify system files, directories or settings.
They more or less have Internet access, not much more.
A service account is configured specifically for services to authenticate.
You still want to implement granularity of
access control, principle of least privilege, but these are used to give
applications their privilege or context to run.
It has administrative privileges based on the application requirement.
Administrator root accounts have elevated privilege on the system.
These typically have global system access, perform high system level functions,
install and uninstall applications, software, sign user permissions, etc.
Then privilege accounts have
administrative control over one or several systems, permitted access to any resources
in the system, configured drivers, add to scrubbed applications, which a lot of
times those are wrapped into administrator root accounts.
But typically that admin or root account is the high level account in the system.
Other privilege accounts may be entities
created with elevated permissions or throw them in like the administrators group.
Shared or Generic Accounts.
It's generally not recommended that you
share accounts for anything because you have no accountability for it.
But a shared generic credentials are shared amongst multiple users.
Typically used when the network is divided
needs individual centralized units for network management.
Application accounts we just talked about.
Service accounts, application accounts,
pretty much the same idea used by applications,
interactive database, execute match scripts.
Group based accounts created
to simplify the process of allocating access rights to individual users.
The advantage to group based access
is that you provide the permissions to the group, you configure access control list
one time, and then you just put users in the group.
There you go.
Throw them in the group, they automatically get permissions.
Then third party accounts are used by
enterprises to handle cloud applications or other third party services.
Typically set up with a cryptographic key
or password based authentication, use Host through APIs or SSH.
Now, again, there are other
variations of that, but those are our classic types of accounts.
That is going to wrap up our module for Module 4.
Up next, Module 5.
See you back here in a few minutes.