Security + SY0 501

Security + SY0 501

1. 1 - RISK MANAGEMENT ()

   • 1) The CIA of Security (5)
     • Confidentiality
       • goal of Keep the data secret of anyone who doesn't have the need or right to access that data
     • Integrity
       • no modification
     • Availability
       • maintain the access of the data available to authorized users when they needed
     • Audition/Accountability
       • Keep track of things that go on. EX: who's been logging and what are they logging
     • Non Repudiation
       • a user can't deny that he performe a particular action
   • 2) Threat Actors - TA (2)
     • Attributes (5)
       • Intent
       • OSINT (Open Source Intelligence)
         • ex: Use of social media records to obtain information
       • Resources
       • Level of sophistication
       • Internal/External
     • Types of TA (5)
       • Hacktivist
         • Intent is a motivation
       • Organized Crime
         • Money is the goal
       • Insiders
         • Not always a employee. They have access to a system (user name and password)
       • Nation States/Advanced Persistent Threat (APT)
         • Entire country with tremendous resources and sophisticated tools to gather intellgence
         • APT - They get into a system and stay there (persistent). The goal is get a naval intelligence or a state department intelligence for example
       • Script Kiddies
         • Trivial attack knowledge
         • easy to block or firewalling
     • People and/or organization that actualy do the type of attacks
   • 3 - Risk (2)
     • Managing Risk (4)
       • 2) Risk Response
         • Mitigation
           • apply security controls to reduce the likelihood of a bad thing will happen
         • Avoidance
           • do nothing
         • Transference
           • Offload the risk
         • Acceptance
       • 1) Risk Assessment/Identification
         • Guides for RA/I (4)
           • Secure Configuration Guides
             • Recomendations by the Vendor
           • General Purpose Guides
             • (general) list of security controls
           • Network Infra Devices
             • Guides for routers, switches, wlans...
           • Benchmark
         • RA/I = Vulnerability Assessment + Threat Assessment
         • Steps
           • I) catalog and define the assets
           • II) List of potential vulnerabilities using a tool.
             • VULNERABILITY SCAN - use a toolkit to list (new) vulnerabilities
             • PEN TEST - Exploits know/found vulnerabilities
           • III) threat assessments
       • 3) Frameworks
         • a methodology/workflow that helps a security pro deal with risk management
         • a) Regulatory
         • c) national standards
         • b) non-regulatory
         • d) international standards
         • e) industry sspeciic frameworks
         • Most famous frameworks: NIST SP800-37 and ISO 27000
         • NIST SP800-37 6 steps
           • I) Categorize
             • Huge list of assets, workflows and process
           • II) Select (SC'S)
           • IV) Assess (avaliar)
             • verify if everything works
           • III) Implement (SC'S)
           • V) Authorize
             • pull everything online
           • VI) Monitor
       • 4) Security Controls
         • The SC came ( are defined) from policies and organization standards
         • it's an action that we apply to our IT infrastructure to do ONE of the two things
           • 1) Protect IT infra: APLLY, MONITORING and ADJUST the SC on the needs of the infra
           • 2) Remediate Problems
         • Categories of SC
           • c) Technical Control
             • Controls actions of IT SYSTEMS make towards IT security
           • b) Phisical Control
             • Controls actions of REAL WORLD ACTORS make towards IT security
           • a) Administrative Control
             • Controls action PEOPLE make towards (em relação) IT security
             • Controls with: Policies, guidelines, best practices
         • SC Functions
           • c) Corrective
             • used to correct a condition when there is either no control at all, or the existing control is ineffective
             • temporary
           • e) Compensative
             • assists and mitigates the risk an existing control is unable to mitigate
           • d) Detective (detectar)
             • recognize an actor's threat
           • b) Preventative
             • Stops the actor from performing the threat. The actor DOES NOT KNOW that control exists
           • a) Deterrent (Dificultar/Intimidar)
             • keeps someone from performing a malicious act. The actor HAS THE KNOWLEDGE of this control
         • Another SC's
           • Mandatory Vacation
             • Vacation in any different times of the year
           • Multi-Person Control
             • more than one people to accomplish a mission
           • Least Privilege
             • use only the necessary resources
           • Separation of Duties
             • Dual execution
           • Job Rotation
     • Is the likelihood of being target by a given attack
     • Terms (5)
       • Assets (ativos) (4)
         • a) Places
         • b) People
         • c) Hardware
         • d) Software
       • Vulnerabilities
         • weakness of an asset
       • Threats
         • negative event who exploits a vulnerability
         • Structural Threat
           • fail on an equipment or lost of power supply
         • Accidental Threat
           • Authorized people who doing something wrong accidentaly
         • Adversarial Threat
           • Hacker or a Malware (intentional)
         • Enviroment
           • fires, earthquake
       • Likelihood (2)
         • defines the level of certainty that something bad will happen
         • Quantitative Risk
           • porcentage
         • Qualitative Risk
           • risk low, medium, high
       • Impact
         • Harm caused by a threat
     • THREATS + (applys) VULNERABILITIES = RISK
     • FORMULA RISK = PROBABILITY X LOSS
   • 5 - Defense in Depth (2)
     • Diversity VS Redundancy
       • 1) Diversity
         • ADM TECH PHIS
         • Different types of controls in a same objective. EX: block facebook warning in policy and block the website in work hours
         • Vendor Diversity
           • Method of Defense in depth with technicals controls
       • 2) Redundancy
         • Add layers of the same type of control. EX: block malware with antimalware on a pc and on a firewall
   • 6 - IT Secure Governance
     • 1) Sources (4)
       • a) Laws and regulations
       • b) Standards
         • Government standards
         • Industry Standards
       • d) Common Sense
       • c) Best Practices
     • Influences how the organization conducts IT security
     • 2) Documents (4)
       • b) Organizational Standards
         • Defines the acceptable level of performance for our policy
         • Much more detailed than a policy
         • EX: Policy: use a strong password. OS: 12 chars alphanumerics
       • c) Procedures
         • a step by step processes
       • d) Guidelines
         • Optional
       • a) Policies (7)
         • I) Acceptable Use Policy (AUP)
           • document that identifies exactly what is appropriate and what is not appropriate activity on an organization’s network
           • RULES OF BEHAVIOUR
           • document of a new employer have to sign
         • used as directives. EX: this will do this
         • VI) Privacy Policy
           • defines how your data, or data usage will be shared with other resources
           • are often for customers. Ex: facebook and the use of our data
         • V) Care and Use of the Equipment
           • Maintenance of the equipment
         • IV) Password Policy
           • Password recovery, bad login, password retention, password reuse
         • III) Access control Policies
           • defines how to get acces to data or resourcers by the job you have
         • II) Data Sensitive and Cassification Policies
           • Classifications and labels
         • VII) Personnel Policy
           • People using OUR data
         • Document that defines how we're going to be doing something. EX: policy that defines what employers can or can't do on the organization equipments
         • Broad in nature
         • Define roles and responsabilities
   • 7 - Business Impact Analisys (BIA)
     • Privacy Threshold Assessment (PTA)
       • is a process that a company uses to analyze how personal information is protected within an IT system. This process reviews how the information is collected, manipulated, transferred, or transmitted.

2. 2 - CRYPTOGRAPHY (10)

   • 1 - Basics ()
     • 2) Encryption/Decryption
       • a) Cesar Cipher
         • Substitution
           • Cornestone of Caesar Cypher
       • c) Exclusive OR (XOR)
         • Phrase to binary
       • b) Vigenere Cipher
         • Caesar Cipher + Confusion
       • Data encryption
         • a) Data at Rest
           • data encrypted stored on hard drive
         • c) Data in process
           • data in RAM or CPU
         • b) Data in transit
           • Ex: IP call or a text message
     • 1) Obfuscation
       • Diffusion
         • make less visible, less obvious
       • Confusion
         • make stirred up (agitado)
   • Study of taking data and make it hidden in some way so that other people can't see it
   • Provides CONFIDENTIALITY and INTEGRITY
   • 2 - Cryptography Methods
     • 1) Simetric Encryption
       • Primary way we encrypt data
       • Session Key
         • Key used in a moment of the exchange
         • Forms of exchange
           • OUT-BAND - Send the key outside the network
           • IN-BAND - Send the key with the encrypted data. VERY RISKY
         • Ephemeral Key - temporary key
           • Perfect Forward Secrecy (PFS)
             • Method of exchange key in every single session
     • 2) Asymmetric Encryption
       • Key pair
         • Public Key
           • Only ENCRYPT
         • Private Key
           • Only DECRYPT
       • Used to send a secure session key
     • Cryptosystems - Highly defined process tha programs do to define key properties, communications requirements for key exchange an actions taken through encryption and decryption
   • 4 - Asymmetric Algorithms
     • b) Elliptic Curve Cryptography
       • VERY SMALL KEYS but with the same robustness as RSA keys
     • a) Rivest Shamir Edelman (RSA)
       • PRIME NUMBERS
       • Larger keys
     • c) Diffie-Helman
       • Used to EXCHANGE SYMMETRIC KEYS
       • DH GROUPS - table used for negotiation the size of the key
       • DH does not encrypt or authenticate
       • EDH - Ephemeral DH - PFS
       • ECDH - Elliptic Curve Diffie-Helman
     • d) Pretty Good Privacy (PGP)
       • originally used for E-MAIL encryption
       • Public Key Private Key Random Key
       • PGP Certificate - Web of Trust
       • Payd Version (Symantec)
         • Encrypt Mass Storages, Cloud Solutions and bitlocker
       • OpenPGP - Free
         • Encrypt e-mail, S/MIME, PKI support
       • GNU Privacy Guard (GPG)
         • Encrypt files and disk
         • OpenPGP
   • 5) Hashing
     • Provides Integrity
     • Fixed Value of MESSAGE DIGGEST
     • one way
     • Hash Types
       • a) Message Diggest 5 (MD5)
         • Grandpa of Hashes
         • 128bit hash
       • c) Race Integrity Primitives Evaluation Message (RIPEMD)
         • Open Standard
         • NOT very common
         • 128, 160, 256 and 320bit versions
       • b) Secure Hash Algorithm (SHA)
         • Developed by NIS
         • SHA 1
           • 160bit hash
         • SHA 2
           • Separated by the lenght of the bit hash: SHA 256 or SHA 512
       • d) Hash Based Message Authentication (HMAC)
         • HMAC - MD5 HMAC - SHA1
         • Integrity authenticity
         • used in protocols as IPSEC and TLS
         • HASH + SECRET KEY
     • Collision - 2 different hashes with the same value
     • Use of Hashes - PASSWORD CHECK and Encryption
   • 6 - Steganography
     • Process of taking some data and hide in other data
     • the message may or may not be encrypted
     • commonly used with graphic images
   • 7 - Certificates and Trust
     • 2) Types of Trust
       • c) PKI
         • I) Certification Authority (CA)
         • II) Intermediate CA
       • b) Web of Trust
       • a) Unsign Certificate
       • d) Mutual Authentication
     • 1) Concepts
       • a) Digital Signature
         • Hash of a document using a private key of the sender
         • Authentication - proves source of the message
         • Non-Repudiation
         • the message dosn't need to be encrypted
       • b) Digital Certificate
         • I) Sender Public key
         • II) Sender Digital Signature
         • III) Third Party Digital Signature
     • 3) CRL and OCSP
       • a) Certificate Revocation List (CRL)
       • b) Online Certificate Status Protocol (OCSP)
     • 5) Chain of Trust
     • 4) Key escrow (garantia)
     • 6) PKCS
       • a) PKCS 7
       • B) PKCS 12
   • 8 - Cryptography Attacks
     • Password Attacks
       • a) Brutte Force
       • b) Dictionary Attack
       • c) Rainbow Table
       • Salt
   • Algorithm + key
     • Algorithm - math operation who convert data from plaintext to cyphertext (vice versa)
   • Cryptoanalysis - break encrypted codes
   • 3 - Symmetric Cryptosystems
     • Block Cipher
       • Blocks with fixed size (generaly 64bits)
     • 1) Algorithms with block cypher
       • b) Triple Data Encryption Standard (3DES)
         • 64bit block size
         • 16 rounds
         • 128BIT KEY
       • a) Data Encryption Standard (DES)
         • 64bit block size
         • 56BIT KEY = 64bit - 8bit dropped
         • Feistel Function
         • 16 rounds
       • d) Advanced Encryption Standard (AES) (Rijndael)
         • 128 block size
         • 128, 192 or 256 key size
         • Winner of the american government contest
       • c) Blowfish
         • 64bit size
         • 16 rounds
         • 32 to 448 key size
       • e) Twofish
         • Finalista com o AES
     • Streaming Ciphers
       • Randomization
         • One bit at a time
         • Uses XOR to randomize
     • 2) Algorithm with stream cypher
       • Rivest Cipher 4 (RC4)
         • 40 - 2048 key size
     • 3) Symmetric Block Modes
       • a) Eletronic CodeBook (ECB)
         • uses Same key - generates same results
         • not used anymore
       • c) Cipher Feedback (CFB)
         • I) Encrypt the I.V
         • II) XOR the encrypted I.V with the plaintext
         • III) The cyphertext replaces I.V in subsequent rounds
       • b) Cipher Block Chaining (CBC)
         • I) XOR I.V and Plaintext
         • II) Encrypt the result generating the CYPHERTEXT
         • III) The cyphertext replaces I.V in subsequent rounds
       • d) Output Feedback
         • Same as CFB
         • The only difference is that the I.V never changes
       • e) Counter (CTR)
         • I) N+C is Encrypted
         • NONCE + COUNTER (0, 1, 2, ..., N, N+1...)
         • II) The result is XORed with the plaintext
         • III) CYPHERTEXT 0 CYPHERTEXT 1 CYPHERTEXT N CYPHERTEXT N+1
         • NONCE - is an arbitrary number that can be used just once in a cryptographic communication

3. 4 - Tools of the Trade

   • 1) OS Utilities
     • a) Ping
       • No need to use the command -t in a linux system
       • used to verify that a device can communicate with another on a network
       • uses ICMP protocol
       • DNS Tool
     • b) Netstat (network statistics)
       • netstat - n
         • shows with who you communicate
       • is a command who shows with whom you talking and who you listen
       • show ports who you are comunicating
       • netstat - a
         • shows all active conections (open ports to see which are listening)
     • c) tracert (Trace Route)
       • is a function which traces the entire path (of routers) from one network to another.
     • d) Arp (Adress Resolution Protocol)
       • Resolves IP adress to MAC adress (associate a local IP address with the MAC address)
     • e) ipconfig
       • providest the IP Adress and the ethernet details
       • the -all shows the MAC Adress
       • Ifconfig does the same on linux
     • g) netcat
       • Open ports and put on listening mode. Used for aggressive actions. Used for PEN TEST and VULNERABILITY ASSESSMENT
       • Become a BACKDOOR
     • f) nslookup
       • queries (consultas) to a DNS server, and quick change to another server. Shows our server and the adress
       • DIG does the same on linux
   • 2) Network Scanners
     • a) Nmap (network mapper)
       • allows you to gather information from ALL of the different devices across the network
       • Performs Port, OS and Service scan
     • used to determine what services might be running on a remote device
   • 3) Protocol Analizers
     • a) Wreshark
       • I) Sniffer
         • Tools that are actually grabbing all the data that's going in and out of a particular
       • II) Broadcast Storm
         • A state in which a message that has been broadcast across a network results in even more responses, and each response results in still more responses in a snowball effect
     • Protocol analyzers are tools that have for two functions: 1 - Sniff and 2 - Analyze the network traffic coming in and out of a specific host computer
     • b) TCP DUMP
       • Runs only on LINUX
       • Sniff better than Wireshark
   • 4) SNMP (Simple Network Management Protocol)
     • 1 - Actors
       • SNMP Manager
         • Ports: UDP 162 and TLS 10162
         • Network Management Station (NMS)
           • Interface who did the queries to all managed devices
       • Agent
         • It's a MANAGED DEVICE
         • Ports: UDP 161 and TLS 10161
         • Management Information Base (MIB)
           • Built in every managed device
           • it's the way to talk properly to differents agents
     • 4 - CACTI
     • 3 - Versions
       • V1 - without encryption
       • V2 - Basic Encryption
       • v3 - TLS
       • this 3 versions talks to itself
     • 2 - Commands
       • Walk
         • It's a batch of GETS
       • GET
         • NMS send some query to a managed device
       • Trap
         • TRAPS are initiated by the Agents
         • It is a signal to the SNMP Manager by the Agent on the occurrence of an event
     • 5 - Comunity
       • Group of Managed Devices
   • 5) Logs
     • 1 - Groups
       • a) Non-Network Logs
         • I) OS Events
           • Host starting Host shutdown OS updates Reboot
         • Events that take place on a host even if that host is unplugged from a network
         • II) Application Events
           • App Instalation App Starting
         • III) Security Events
           • Logons success and falures
         • They probably have a DATE, TIME, Account and Event number
       • b) Network Logs
         • Is something that takes place on a host that has to deal with the communication between that host and something on the network
         • I) OS level
           • Remote Logons (succes or fail)
         • II) App level
           • Activity on Web Server
           • Activity on Firewall
     • 2 - Forms
       • 2 - Decentralized Logging
         • Logs in every computer of a network
       • 1 - Centralized Logging
         • uses a central repository
         • SNMP Systems
     • 3 - Monitoring as a Service (MaaS)
       • Service offered by third parties to monitor all logs of an organization

4. 5 - Securing Individual Systems

   • 1) Denial of Service (DoS)
     • a) Volumetric Attack
       • I) Ping Flood
       • II) UDP Flood
       • Easy to stop today
     • b) Protocol Attack
       • I) SYN Flood/TCP SYN Attack
       • Do naught things to the protocol to create confusion
       • The most common type of DoS Attack
       • Still a huge problem today
     • c) Application Attack
       • I) Slow Loris attack
         • Loris é um animal devagar
       • II) Amplification Attack
         • Smurf Attack
           • The attacker broadcasts ICMP packets attached with the false IP address (spoofing) of the victim. The others computers respond this request and flood the server.
     • DDoS - uses BotNet, and are the nightmare of attacks
   • 2) Host Threats
     • a) SPAM
       • Can't cause danger
       • Often came from a legitm source
     • b) Phishing/ Spear Phishing
       • For the exam, came only from EMAIL
       • Phishing - broadcast E-MAIL that trying to take some personal information of the victm/victms.
       • Spear Phishing - individual target, craft a fake email tailored for that person
     • c) SpIM
       • receive spam via INSTANT MESSAGING
     • d) Vishing
       • V from VOICE - Phone
     • e) ClickJacking
       • Click in something and goes to another site
     • f) Typpo Squading
       • use of similar web sites like gogle.com, waiting for someone type a wrong address and goes to a similar but naughty site
     • g) Domain Hijacking
       • when somebody hijack your domain and ask for money to give it back
     • h) Privilege Scalation
       • Get higher privilege to do naughty things on the system
   • 3) Man-in-the-Middle
     • a) Wired MitM
     • Intercepts the communication and passes it to another destination
     • ARP Poisoning
     • Ettercap - ferramenta de segurança de rede gratuita e de código aberto para ataques man-in-the-middle na LAN
     • b) Replay Atttack
     • c) Seesion Hijacking

5. 7 - Secure Protocols

6. 8 - Testing Your Infrastructure

7. 9 - Dealing with Incidents

8. 3 - Identity and Access Management ()

   • 1) Identification, Authorization, Authentication (3)
     • 1 - Identification
       • FIRST STEP in the process and involves the user show his/her credential to the system
       • EX: type a username in a logio screen
     • 2 - Authentication
       • Authentication factors
         • b) Something you have
           • Token
           • Smart Card
           • RSA Key
         • a) Something you know
           • Password
           • Pin Code
           • Captcha
           • Security Questions
         • c) Something you are/about you (physically)
           • Biometric
           • Iris Scanner
           • Facial Recognition
         • e) Something you do
           • The rhythym of a person typing a password
         • d) Somewhere you are
           • uses geography
         • Multifactor Authentication
           • Password + Biometric
       • Federation
     • 3 - Authorization
       • What rights do I have to the system, ONCE AUTHENTICATED
       • Concepts
         • Permissions
           • Administrator has to assign (atribuir) permissions
             • EX: permission to write an archive
           • We apply to resources
         • Rights/Privileges
           • assign to a systems
             • EX: right to be able to change password, or right to log remotely
           • Strategies
             • Least privilege
             • Separation of duties
   • 2) Access Control List
     • Authorization Models (5)
       • 1) Mandatory Access Control (MAC)
         • the OPERATING SYSTEM provides limits of access
         • Every object gets a label
           • Rules of access defined by the admin
             • Users CAN'T change this settings
         • Strong Method
       • 2) Discretionary Access Control (MAC)
         • a) used in most operating systems
         • b) the creator of the archive is the OWNER and can modify access at any time
         • c) The owner define the permissions for the other users
         • d) Flexible and weak
         • Access properties are stored in ACL's
       • 3) ROLE Based Access Control (RBAC)
         • Windows uses GROUPS
         • broader form of control that’s based on your particular role in the organization
           • Ex: Manager, Director, Operator
         • the administrator determines what type of access a user has
       • 4) RULE Based Access Control
         • Access is based in a set of rules defined by a system administrator
         • Access properties are stored in ACL's
       • 5) Attribute Based Access Control (ABAC)
         • Complex relationships - access based on many different criteria
         • Combine parameters like IP, time of the day, desired action
       • Implicity Deny - prevents access unless specifically permited
   • 3) Password Security ()
     • Security Policy (3)
       • 1) Complexity
         • Length and characters requirements
       • 2) Age or Expiration
         • Reset and time triggers
         • Minimum password age
           • force users to use a password for a minimum amount of time before they are allowed to change it. EX: 2 days
         • Maximum password age
           • used to EXPIRE a password after a certain time period.: EX: 180 days
       • 3) Password History
         • Reusage and Retention
         • simply records a previous number of passwords, so that they cannot be reused in the system
       • 4) Group policy objects
         • Active Directory is an example
           • Applied to Domains, Groups, Individual sites, Organization Units
   • 4) Linux File Permissions
     • rwxrwxrwx
       • 3 primeiros OWNER/CREATOR
       • 3 do meio GROUP
       • 3 finais EVERYBODY ELSE
       • r - read
         • w - write
           • edit, add or delete a file
         • x - execute
           • run a file and CD to a different directory
           • go to another directory only if you have the X permission
         • Open a file and view contents
     • CHMODE
       • command that allow to change permissions
       • r=4; w=2; x=1
         • EX: r-x = 5; -w- = 2; rwx= 7
       • Need a SUDO command before
     • CHOWN
       • command that allow to change the OWNER of a particular file
       • Need a SUDO command before
     • PASSWD
       • command that allow to change the user password
   • 5) Windows File Permissions
     • NTFS permissions
       • Accepts set individual permissions
       • Create users and put them into groups with NTFS permissions
       • INHERITANCE
       • 1a) Commands to a folder
         • 4) List folder contents
           • Just see the contents of folder, subfolders and archives, but NOT have the access to read them
         • 1) Modify
           • R, W and delete subfolders and files
         • 2) Read/Excecute
           • See contents and run programs
         • 3) Write
           • write to files and creates new files and folders
         • 5) read
           • view contents and open data files
       • 1b) Commands to a file
         • 1) Modify
           • R,W and delete the file
         • 2) Read/Excecute
           • Open and run the file
         • 3) Write
           • Open and write to the file
         • 4) read
           • Open the files
         • DENY CHECKBOX IS STRONGER THAN ALLOW. DENY turn off inheritance
       • 2) copy and move permissions
         • Copy to different drives Copy to the same drive and Move to different drives
           • Do the copy and not keep the NTFS permissions
         • Move to the same drive
           • The only situation that copy and keeps the NTFS permissions
   • 6) User Account Management
     • 1) Continuous Access Monitoring
       • Track LOG IN/LOG OFF activity
       • Track file access
     • 2) Shared Accounts
       • Don't do Shared Accounts!
     • 4) Default Accounts
     • 3) Multiple Accounts
       • Use different names and passwords
   • 7) AAA
     • Identification
       • Usualy your USERNAME (who you claim to be)
     • Authentication
       • Need to be Centralized
       • proves you are who you say you are
       • your PASSWORD and others authentication factors
     • Authorization
       • what access do you have? (after ID and Authentication)
     • Audition
       • Resources used: Login time, data sent and received, Logout time
     • usernames/passwords
     • Uses Multi-factor authentication
     • Types of system who took care of AAA:
       • b) Terminal Access Controler Assess-Control System Plus (TACACS+)
         • Really good in manager a bunch of devices
         • Decouples authorization from authentication taking care of both more carefully
           • Takes care of authorization aspect really well
         • TCP port 49
         • Good in auditing
         • Encrypts all the information betwenn user and client
         • c) DIAMETER
           • EAP
       • a) Remote Authorization Dial-In User Service (RADIUS)
         • As it says, support DIAL-IN network
         • I) RADIUS SERVER
           • The system that checks the authentication is the RADIUS server
         • II) RADIUS CLIENT
           • is the GATEWAY in the middle of whos trying to get authenticated and of who authenticates
         • III) RADIUS SUPLICANT
           • the person/system who's triyng to get authenticated
         • Protocol who offers centralized management of AAA for users who connect and use the service
         • Used for network access
         • Can use up to 4 different ports: 1812 1813 (TCP/UDP)
         • Mix the authorization and authentication services
           • Not so good (sometimes do not do) authorization
           • Good in authentication
         • Good in Auditing
         • Encrypt only the password between user and client
   • 8) Authentication Methods
     • a) Password Authentication Protocol (PAP)
       • Just pass to the server username and password IN THE CLEAR
       • Is not used anymore
     • b) Challenge-Handshake Authentication Protocol (CHAP)
       • First to give some form of protection to the authentication process
       • MS-CHAP is the Microsoft version of the protocol
         • To encrypt all the traffic btween cient and server, MS-CHAP uses Microsoft Point-to-Point Encryption (MPPE)
       • Steps
         • I) After link is established, the Server sends a challenge message to the client
         • II) The Client responds with a password hash
         • III) Server compare send and stored hashes
         • IV) after this process, the server continues sending challenges periodically. Users never know it happens
       • MS-CHAPV2 uses new feature of authenticate user and client
     • c) NT LAN MANAGER (NTLM)
       • Same as CHAP but this time, Client and Server exchange Challenger Messages
       • Double check (server and client sides)
     • d) Kerberos
       • Domain Controlers is known as Key Distribution Center (KDC) who has 2 main functions:
         • a) Authentication Service
           • listen on TCP/UDP 88 PORTS
           • Distributes a TICKET GRANTING TICKET (TGT) who shows that the client is authenticated (but NOT authorized) to the system
         • b) Ticket Granting Service
           • listen on TCP/UDP 88 PORTS
           • Gets the TGT and generates a SESSION KEY to the client with only the authorization that he needs
           • A new session key is generated every time
       • Authenticate once, trusted by the system (Multi-Authentication)
         • No need to reauthenticate
         • Protected aganist Man in the middle or replay attacks
     • e) Securty Assertion Markup Language (SAML)
       • used for web applications
       • XML
     • f) Lightweight Directory Access Protocol (LDAP)
       • Uses TCP/UDP port 389
       • SSL port 636
     • g) Time-based One-Time Password (TOTP)
       • Generates temporary password and change in a period of time
   • 9) Single Sign-On (SSO)
     • Secure Assertion Mark-up Language (SAML)
       • 1 - Concepts
         • a) Identity Provider (IP)
           • is a system entity that issues authentication assertions in conjunction with a single sign-on
         • b) Service Provider
           • All the different web apps
           • EX: Cameras, Printers,
       • For web apps
       • Allow to login into a whole bunch of devices
       • 2 - Steps
         • I) The client sign on into the Identity Provider who gives an authentication TOKEN to the client
         • III) And then all the service providers are available to the Client
         • II) The Identity Provider connects with the Service(s) Provider(s) via VPN
     • Federated Systems
     • LAN uses Active Directory as Single Sign-On tool
     • Remember the security you going to need:
       • if you talking about LAN, you have to use ACTIVE DIRECTORY
       • If you talk about widespread all over the place, you have to use SAML
     • (Secure European System for Applications in a Multivendor Environment) SESAME
       • is a European-developed authentication protocol that can provide for single sign-on capability
     • Uses LDAP and Kerberos

9. 6 - LAN

   • 6.1 - The Basic LAN
   • 6.2 -Beyond the Basic LAN