COMPUTER SECURITY

COMPUTER SECURITY

1. AUTHENTICATION

   • User Authentication
     • Process of validating a person identity
   • Password Authentication
     • user provides name/login and pswd
     • authenticates ID of user logging
     • Password Vulnerabilities
       • offline dictionary attack
       • specific account attack
       • popular password attack
       • password guessing against single user
       • workstation hijacking
       • exploiting user mistakes
       • exploiting multiple password use
     • widely used user authentication method
     • Password cracking
       • Dictionary attack
         • try each word then obvious variants in large dictionary against hash in password file
       • Rainbow table attacks
         • precompute tables of hash values for all salts
         • a mammoth table of hash values
         • not feasible if larger salt values used
     • using better password
       • clearly have problems with password
       • goal to eliminate guessable password
       • whilst still easy for user to remember
   • Used of hashed password
   • UNIX implementation
     • 8 character pswd from 56-bit key
     • 12-bit salt used to modify DES encryption into a one-way hash function
   • Token Authentication
     • embossed card
     • magnetic stripe card
     • memory card
     • smart card
   • Biometric Authentication
     • authenticates user based on one of their physical characteristic
       • hand
       • signature
       • face
       • voice
       • retina
       • finger
       • iris
     • never get identical templates
   • Authentication Security Issues
     • client attacks
     • host attacks
     • eavesdropping
     • replay
     • trojan horse
     • denial-of-service attack

2. ACCESS CONTROL

   • Meaning
     • The prevention of unauthorized use of a resource
   • Policies
     • • MAC
         • -based on compare security label with security clearance
       • DAC
         • -based on identity of requestor & authorization
           • state what requestor are allowed / x allowed to do
         • termed descretionary because :
           • entity might have access rights that permit entity
           • by its own volition
           • to enable another entity access some resource
         • provide using access matrix
         • can decompose by row/column
       • RBAC
         • -based on roles that users have within system
         • -based on rules stating what accesses are allowed to users in given roles
   • Requirements
     • reliable input
     • fine & coarse specification
     • least privilege
     • separation duty
     • open & close policies
     • policy combinations, conflict resolution
     • admin policies
   • Elements
     • subject
       • owner
       • group
       • world
     • object
     • access right

Images and files in the map