-: Now that you understand a little bit
about what identity systems are,
let's talk about some of the specific threats
that face your identity systems.
There's three basic threats.
The first one is threats to the underlying
authentication and authorization system.
This can include things like attacking the way
that users log on,
the way the credentials are handled
or how the users are authenticated or authorized.
The next one you have is targeting the account lifecycle.
This can go after the creation of the credentials.
It can prevent credential removal
when somebody is fired
or taken out of the organization for instance
or elevating privileges of existing credentials,
and the third way is to attack the account itself,
and this can go after things like going
after your personnel and phishing them
to try steal their username and password
by having them give it to you
or compromising the systems
that hold the credentials themself.
Now, the first one I want to talk about
more in depth here is personnel threats.
This is targeting of your users.
This is usually done through
social engineering techniques or phishing.
For example, if I pick up the phone
and call one of your users and say
hey this is Sam from the help desk,
I heard your account was locked out,
what's your password,
let me verify it for you,
and they give me their password.
That's a social engineering technique right?
Or I send them an email
and say click this link to reset your password,
they type in their username and password
and now I've got their information.
User awareness training can help prevent
these type of things as we've talked about previously,
and the other thing that will fall under your
personnel threats besides phishing
and social engineering will be anything
that has to do with insider threats
because they are a personnel-based threat.
Anytime you have an insider threat,
somebody like a trusted admin who is creating
false accounts or overusing their privileges,
this is a personnel-based threat.
The next one we want to talk about is endpoint threats.
The other way we can attack these credentials
is by targeting your endpoints.
For instance, if I have a local exploit on your laptop,
that's gonna give me access to it.
If I put a keylogger on your laptop,
I now collect your password.
If I have local administrative credentials
on your laptop,
I can try to elevate those into domain creds right,
and if I have password stores and tokens
that are stored on your laptops, which they all do
and I can steal those,
I can then try to reverse engineer them and crack them
to get your passwords that way.
You can protect this by using anti-malware
and anti-virus which will help stop
some of the keyloggers and the local exploits,
and you can protect the stores,
the key stores themself by using strong
authentication methods by using
long authentication passwords,
having those salted and using a good solid hash scheme
like a SHA-256 or greater.
Some other threats that exist out there
are things like server-based threats,
application or service-based threats
and roles, rights, and permission threats.
When we talk about server-based threats,
we're talking about attacking the servers themself.
If we attack your servers and then they send
the identity authentication information
to the AAA servers on their behalf,
that's a threat going after the server.
We'll talk more about this in future lectures as well.
Application and service threats are gonna focus
on attacking the applications and servers
and in the next few lectures again
we're gonna cover these in much more depth,
and then you have roles, rights and permission based,
and this is where we start focusing on the users by placing
them into the wrong user groups,
giving them additional roles,
giving them additional rights
and giving them additional permissions,
and again we'll talk about this more
as we go into the directories in more depth.