-: Securing Authentication and Authorization.
So as I've gone through and pointed out a lot
of these flaws, I've given you a lot of tips and tricks
of how you can secure your authentication and authorization.
In this lesson, I want to summarize those
and add just a couple more so you really have just one place
to look as you're starting to study for the CSA exam
of how you can secure these things.
So when I talk about securing authentication,
this is the technical and administrative controls
that can help secure the authentication process.
This is starting out with things like using strong
passwords or long passphrases as your
authentication mechanisms.
Now, password management is always a concern.
We talked about that in the password re-use section.
So you want to consider things like a single-sign-on
solution, a token-based or multifactor authentication,
and password safes, things like LastPass or Dashlane,
where you have one master key that will unlock unique
individual passwords for each application.
You could also make sure that you're encrypting your
communications between your clients and your authenticators
using TLS tunnels to ensure nobody's snooping
and stealing those passwords that way.
So, how do you secure your authorization of your users?
Well, you're gonna make sure you have proper access
control to ensure the users are matched with the right
rights, privileges and groups.
You're gonna use policies that are gonna control what rights
are given to which users and which groups,
and then you're gonna implement a management system
for approving those rights, and make sure there's proper
checks and balances in place.
You also want to make sure you're monitoring this
and reporting on it, to ensure you know which accounts
have which rights assigned and insure there's no
privilege creep.
The next thing we wanna talk about from an admin
perspective, how do you secure authorization?
Well, do you want to make that privileged users
have proper management, and there's different concerns
when you're dealing with admin rights going to users,
because if I'm going to give someone a domain admin
or even a power user ability, they have rights to do things
like installing software that can install bad things.
They can create new user accounts or give more permissions
to other people and do bad things.
So we have to be concerned with this.
We wanna make sure that we give these accounts,
these admin accounts, additional monitoring and logging.
We want to look at them closely and make sure
they're doing the rights things with their credentials.
The next thing you wanna look at is making sure there is
a clear separation of duties.
Where possible, make sure backup administrators
only have backup rights.
Make sure that email administrators only have admin rights
on the email servers.
Don't just give them blanket domain credentials.
And use appropriate training.
Make sure you train your admins, because when they
make a mistake, it's much more detrimental to you
then what a standard user does.
Now, you also want to make sure you're preventing
your admin accounts from being used as daily accounts.
I went to one organization where I logged in
and I checked all my admin accounts, and I saw that
there was one admin that was logged in nine hours a day.
No admin needs to be logged in nine hours a day,
and I started looking at what he was doing,
and half of the day, he was surfing Facebook.
From his admin account.
So if he clicks on the wrong thing, he clicks on
some malware, he clicks on some kind of malicious link,
guess what?
He just ran that program as an admin.
That's bad news.
Make sure that they're using their normal account,
and then they're elevating their permissions
using login as or switch user as, and then go into
the admin mode, do their admin functions, and then go back
to the normal user account.
Only go to admin when you need it.
So, multifactor authentication.
I mentioned this a couple of minutes ago.
Let's talk a little bit in multifactor, because I guarantee
you're gonna see some questions on the exam.
If you don't remember this from Security Plus,
that's okay, I'm gonna show you right now.
But multifactor authentication is using two or more factors
of authentication.
So what's a factor of authentication?
Well, there's four of them.
There's knowledge factors, possession factors,
biometric factors, and location factors.
Knowledge factors are things that you know.
Something that you know, things like a username,
a password, a pin number.
When you talk about possession factors,
it's something that you have.
So that would be like a smart card or an RSA key fob,
that's shown here in the picture.
Or it could be something like Google Authenticator app
on your smartphone, because they know you have your phone,
and therefore, you have those numbers shown on the screen,
and they change every 15 or 30 or 60 seconds.
The next one you have is biometric factors,
and these are something that you are.
Fingerprints, voice recognition, eyeball or retina scans,
those kind of things.
And then the last one we have is location factors,
which would be either based on your IP address
or based on your GPS coordinates, and this is more commonly
used with smartphones than it is with other devices.
Now, when you combine two or more of those,
that gives you multifactor authentication.
Next, we want to talk about context-based authentication,
and this is becoming more and more popular recently
as more cyberattacks are happening.
Context-based authentication is an authentication
decision that is based on information about you, the user,
the system you're logging in from, or other such factors.
This can be things like your user's role
or group membership.
This can be the time of day in relation
to your normal duties.
If I put into the system that you're normally logged in
between eight and five, I can then say, any time after
five PM, you can't log on again until eight AM.
That's a context-based authentication.
IP address and reputation.
Maybe there's certain countries that we don't trust,
because more malicious attacks come from those countries,
and so, our network is not gonna let you log in
from one of those countries.
It'll do that based on your IP address or your geolocation.
The next thing you can look at is frequency of access.
Maybe you can't log on multiple times in a single day.
You can't have two different logons at the same time.
Those are context-based authentications.
And then you have the type of device.
Maybe you always log in from a Mac computer,
and now you're logging in from a Windows.
You ever see that thing where it pops up on your screen
and says, verify it's you?
Tell me what city you were born from.
When we send a text message to your cell phone,
put in that pin number.
Something has a second factor to verify it's you
when you come in from some unknown or unusual context.
I travel a lot, so I get these all the time
from Google and Facebook.
When I try to log in, it goes, hey, you're coming from
some location I don't recognize.
Normally, you're in America, and now you're sitting
in Japan, why is that?
Is this really you, Jason?
And then I give them some proof
and they let me log in, right?
That's context-based authentication.