Karteikarten
Security Foundatoins & Authentication
Karten in diesem Stapel (48)
- 1Computer Security (cybersecurity)Computer Security (cybersecurity) – protection of computer systems and information form harm, theft and unauthorized use. And networks.
- 2DataData: personal info, protected health information, intellectual property, government, industry, university.
- 3Malicious users canMalicious users can: modify and change a program’s source code; use someone else’s pictures or email accounts to created derogatory content such as fake misleading and offensive media accounts; crash someone’s computer system to create data loss; use computer for attacking other computers, websites or networks for creating havoc.
- 4Bot (web robot)Bot (web robot) – software application that urns automated tasks (scripts) over the internet.
Created when malware (to remotely control a computer) is placed onto a target computer. - 5BotnetBotnet (robot network) – network of malware infected computers running one or more bots.
- 6DDOSDDOS – Distributed Denial of Service – legitimate access to a website is hampered or denied by botnet sending so many requests to the websites server, the server becomes overloaded, slow or even crashes.
- 7Data theft is most expensive and fastest-growing segment of cybercrime. Lack of security can damage organisations: 3- Economic Cost: theft of intellectual property, corporate info, disruption in trading and cost of repairing damaged systems
- Reputational Cost: loss of consumer trust, loss of current and future customers to competitors and poor media coverage
- Regulatory Cost: GDPR and other data protection laws means can suffer from large regulatory fines or sanctions - 8Fundamental purpose of a computer systemFundamental purpose of a computer system: computer is an electronic device for inputting, outputting, storing and processing data according to instructions that are provided by computer programs. Programmable device that stores, retrieves and processes data. Working with data.
- 9How data can be compromised 3How data can be compromised: unauthorized discloser, modification or withholding of data
- 103 key properties of Computer security1. Confidentiality – against discloser
2. Integrity – against modification
3. Availability – against withholding (CIA triad) - 11CIA explain eachConfidentiality: only authorized users can access specific data.
Integrity: data is authentic, accurate and reliable. Only authorized users should be able to modify specific data when needed. Data must be accurate and consistent.
Availability: data should be available to authorized users when needed. - 12RansomwareRansomware – type of malware which prevents access to devices and data stored on them, usually by encrypting data files. Criminal group will then demand a ransom in exchange for decryption.
- 13More security Properties and what thye meanMore security Properties: Authentication. Non-repudiation.
Authentication: determining whether someone or something is in fact who or what it says it is.
Non-repudiation: ability to ensure that someone cannot deny or contest responsibility for their action(s). Unforgeable evidence. Ie proof of delivery. Closely related to accountability – users should be responsible for their actions. - 14ThreadThreat – potential negative action or event that has potential to harm a computer system
- 15VulneratbilityVulnerability – weakness in a computer system that can be exploited by a threat to deliver a successful attack
- 16Risk + equationRisk – potential (or change) for loss or damage when a threat exploits a vulnerability
Risk = Threat * Vulnerability - 17Many aspects to computer security multilayeredMany aspects to computer security including: network security, endpoint security, information security, cloud security, IoT security, Mobile security, application security.
Multilayered: physical security, security and processes and policies, technical security. - 18Computer SecurityComputer security: controlling physical access to computer hardware. Controlling malpractice by users, whether intentional, accidental or due to being tricked into deviated from secure procedures. Protecting against harm that may come via network access, bad data or code injection.
- 19Software security application security approachesSoftware security: proactive approach – within pre-deployment phase
Application security: reactive approach – once software deployed. - 20AuthenticationAuthentication – process or action of verifying the identity of a user.
Authentication – process of validating identity of a registered user before allowing authorized access to protect resources - 21Authentication factor – evidence for authentication. 3 categories:- Knowledge Factor: something you know ie password
- Possession Factor: something you have ie smart card
- Inherence Factor: something you are ie fingerprint - 22Authentication methodsMany authentication methods: password, pin, voice pattern, blood, retina, finger print, signature, biometrics. Smart card, memory card, token, hardware, OTP.
- 23AuthrorisationAuthorisation – process of validating that the authenticated user has been granted permission to access requested resources.\Authentication always before authorization.
- 24Before users can be authenticated by an application need to have previously generated and stored something with the application to be authenticated against:Before users can be authenticated by an application need to have previously generated and stored something with the application to be authenticated against: most common to ask users to create an account through user registration. Account must capture some data or combination of data that uniquely identifies the user ie unique user name/email address. Authenticated when supply data that matches unique data stored in their account.
- 25Users identities must be verified/authenticated before user actions can be authorized. Common and traditional wayCommon way: login credentials: combination of data that is unique to a single user.
Traditional: identifier unique to user: ie username or email. A secret only known by user ie password - 26Authentication can be broken when an attacker is able to be authenticated as a legitimate user. Can happen when logi credentials:- Can be guessed
- Worked out
- Exposed
- Leaked, hacker gets access to - 27Brute force search (exhasustive search)Brute force search (exhaustive search) – problem-solving technique that consists of trying all possible solutions to a problem until a correc solution is found.
- 28Dictionary attackHackers can use software tools to automate brute force attacks. Login POST request continually sent to target server containing username and potential password form set of generated possible passwords.
Dictionary attack – basic software-based brute force attack. Time consuming.
Simple passwords easy to guess/brute force vs complex passwords more likely to be exposed (ie have to write down) - 29why users share passwordsUsers often share passwords for many reasons ie save costs ie share streaming service login credientials, get work done – delegate to someone who needs access to system or account. Own login credentials not working. Can be leaked with severe consequences.
- 30Common security mechanisms to help strengthen authentication: 5Common security mechanisms to help strengthen authentication:
- Password security: strong password policy, auto-generate strong passwords, password expiration…
- CAPTCHA: verifying presence of a human
- Multifactor authentication: one-time pins, time based pins, biometrics…
- Limiting login attempts: locking a user account after n login attempts
- Notification of unrecognized login: users notified and asked to confirm login was genuine if a login attempt made from unrecognized device, location or IP address - 31Web application features that can support and strengthen use of passwords: 7- Strong password policies
- Automatically created strong passwords
- Password strength checkers
- Password recovery
- Changing passwords
- Re-entering passwords
- Hashing - 32Password PolcicyPassword policy – set rules passwords for an application or system must meet ie length and type of char, frequency of password reuse, disallowed usernames, min password age
- 33BlacklistingBlacklisting- password policy may specify a password is disallowed if contains term that is in dictionary of unwanted terms (defines password strength rules that are used to determine whether a password is valid)
- 34Automatcially created strong password considerations: 5- Generated may nto meet password policy
- Can be bypassed with users own password choice
- Hard to remember
- Easily forgotten
- User ends up with multiple passwords - 35Password recovery considerations 4- Users may not be allowed to reuse previous password
- App needs to store preivous passwords
- User ends up with multiple passwrods
- Resetting passwords become regular occurrence - 36Enforced password changes: web applications dealing with sensitive data may force users to change password at set intervals tipically every 30,60 or 90 days. Considerations: 4- Users may not be allowed to reuse previous password
- App needs to store previous passwords
- User ends up with multiple passwrods
- Resetting passwords become regular occurrence - 37Unenforced changesUnenforced changes: existing pass compromised or users may be given default pass when creating account
Web applications dealing with sensitive data may force users to reauthenticate: when accessing specific area of application. After specific time interval. When taking specific action ie bank transfter - 38CAPTCHACAPTCHA – Completely Automated Public Turing test to tell Computers and Humans Apart
Challenge response mechanism used to differentiate between human users and automated bots. Provide challenges difficult for computers to complete but relatively easy for humans. Doesn’t provide additional layers of authentication beyond verifying human presence.
used to be text based. Now image based. Ai now beeting. - 39CAPTCHA Highly effective against all but most sophisticated bots ie AI. Considerations: 5- Distrupted and frustrating for users
- May be difficult to understand or use for some audiences
- Some CAPTCHA types do no support all browsers
- So types not accessible to users viewing a website using screen readers or assistive devices
- Range of automated technologies including plugins, APIs and extentions that enable attackers to bypass or solve CAPTCHA challenges. - 40ReCAPTCHAReCAPTCHA – hosted by google – CAPTCHA software program. 2 versions of image-based reCAPTCHA: asking users to select images matching a theme. Tick a checkbox im not a robot. Uses a key pair: site key (public key) and secret key (private). Site invokes reCAPTCHA service on application. Secret key authorizes communication between applkications backend and reCAPTCHA server to verify users response.
- 41Lock accountsLock accounts – way to go against brute force attacks: defined number of incorrect authentication attempts. Can last a specific duration or accounts could remain locked until manually unlocked by administrator. Not always best solution as someone could easily abuse and deliverately lock out hundreds of user accounts.
Client requests and server responses are stateless. Each is indepent – don’t know what happened in previous requests or responses.
How keep track of number of invalid authentication attemps a user has had especially with many users, database storage has too many overheads. Python flask provides session. - 42SessionSession: object that allows you to store information specific to a user from one request to next. Persists state across requests. May take form of client-side cookie or server side token. Associated with user’s browser/client and not individual users using same browser instance.
- 43ways to unlock accountsUnlocked in various ways: authomatically after period of time. Via text or email. Another form of authentication. Service administrator
- 44Rate limitingRate limiting: slow brute fore attacks by limiting number authentication attempts can be made within a given time frame. Also slows denial of service attacks
- 45MFAMFA- Multi Factor Authenticaiton requires multiple proofs ( factors ) of identiy to authenticate a user. Other factors needed as passwords aren’t always safe. Higher degree of confidence that user is who t hey say they are. Ie OTP. Digital (PKI) certificates: digital certificate, issued by trusted certificate authrotiy, installed on device or in users browser. Idnetify provider can check for presence of valid certificates as well as revoke them at any time. Only browser with valid certificate will be allowed to log in. Biometrics. Identity cards.
- 46Time based pinsTime based pins: users enter PIN ( personal identification number ) within short timeframe typically 30-60 seconds. Generated by software applications or hardware devices with very precise clock.
both web server and authenticator application need to possess shared secret (random key of 32 char in length); matching clocks – current timestamp combined with random key to generate a PIN. Manual- random keys generated in console and typed into authenticator application. Automated –random keys generated by application and converted to QR code which is scannable by authenticator application. - 47Time need to update and rebuild database: 3- Existing user accounts stored in database lost (including MFA keys)
- When re0registering lost usres, they will not have same MFA keys as before
- Authenticator application accounts setup will no longer be valid because generating PINs using ‘lost’ MFA keys - 48How to avoid deleting and adding authenticator application accounts each time user accounts lost following a database update/rebuild: 2- Copy user table contents before rebuilding database (ie in text file)
- Re-register each user and replace re-registered user’s MFA key with previous copied MFA key
Informationen
- Beschreibung
- Uni Uni Second Level (Security Programming) Karteikarten am Security Foundatoins & Authentication, erstellt von HRYN red am 16/12/2024.
- Erstellt von
- HRYN red
- Aufrufe
- 1
- Bewertung