-: Authentication.
As the security of our networks
becomes more important to our organizations,
we have to continue to seek better ways
to increase that security.
Now, although many organizations have been
increasingly adding difficult password schemes
to create a more secure network,
such as using things like upper case
and lower case letters,
numbers,
symbols,
and passwords over 14 characters in length,
studies have shown
that the use of multi-factor authentication
is exponentially more secure.
Nowm what exactly is multi-factor authentication?
Well, it's the use of two or more means
to prove a user's identity.
There are five basic factors of authentication
that you can consider when determining
if somebody is who they say they are.
They are knowledge,
ownership,
characteristic,
location,
and action.
Now, the knowledge factor is concerned
with the user providing a piece of memorized information.
This can be a password,
a PIN,
a combination to a lock,
their mother's maiden name,
their social security number,
their birthday,
their place of birth,
or any other piece of information
that can be memorized
and recited when they're asked for it.
The second factor is what we call the ownership factor.
Now, an ownership factor is concerned with a user
proving that they have something in their possession
that uniquely identifies them.
In the real world,
this might be something like
pulling out your driver's license or your passport.
Now, in the electronic world, though,
we use other things.
Things like token devices
that are small handheld device
that has a randomly-generated code
that changes every 30 to 60 seconds
that the server and the client both know.
It could be something like a smart card
that you insert into a card reader
on your desktop that gives you access.
It could be a USB dongle
where you plug it in
and that gives you access.
Or it can be an authentication mechanism
that sends you a unique and random number
each time you try to log in
and they text that to you
and you, then, enter back in,
showing that you have physical possession
of your cellphone
that accesses your token.
The third thing we have is what's called
the characteristic factor.
Now, a characteristic is defined
as something that the person is.
This is usually accomplished
using some form of biometric technology,
like a fingerprint scanner,
an iris reader,
or a facial recognition unlock feature.
For example,
on the old iPhone 5s,
they had a fingerprint reader
embedded into the home button
and you put your thumb on there
and that would unlock the phone.
Now, on the newer iPhones,
the iPhone X's,
they utilize a dual front-facing camera
that's going to scan your face
and figure out if it is you
based on the distance between different features,
like your nose to your ear.
Another form of this
is called a vocal pattern recognition
where someone is going to speak
and it's going to pick out the pattern of your voice
to uniquely identify you.
This is something that banks are beginning using
to uniquely identify their customers over the phone
before helping them with the customer service.
Now, the fourth factor we have
is called location.
This factor refers to where a person is
when they're trying to log into their account.
For example,
I tend to travel a lot for work.
When I attempt to log into my Gmail account
when I'm traveling,
their system can sometimes flag that as unusual,
and they'll ask me for a second piece
of information to verify
I am who I say I am.
You're organization may require a user
to be within a certain city,
a state, or country before they can log in
based on the GPS of your device or the IP address
from where you're attempting access.
Our fifth and final factor
is called action.
An action refers to something that a user does.
This isn't a commonly-used factor in many networks, though.
The action factor can be something
that talks about how you perform something.
For example,
the way you draw a picture,
or the way you sign your name,
could be used as an action factor.
So, now that we covered the five factors,
I want to drive home a really
important concept for the exam.
If you're only using one of these factors
at a time to identify your user,
this is called single-factor authentication.
Now, sometimes, you can have two
or more things being asked for,
but they're all the same type of one of these five.
For example,
if I say you logged in
using your username and your password,
this is two things.
Is this multi-factor or single-factor authentication?
Well, because a username and a password
are both something you know,
or a knowledge factor,
this is still considered
single-factor authentication.
This is an important concept to understand for the exam.
Now, to increase security,
we want to use at least two factors of authentication,
creating dual-factor or multi-factor authentication.
For example,
if you had a smart card token and a PIN number,
that's something you have,
possession,
and something you know,
knowledge.
You put these together,
that gives you two factors
which is multi-factor authentication.
Now, this is going to be a lot more secure
because you have two different things
that the person has to have
to be able to get into your system.
Security is constantly evolving,
and so, we're always adding additional
mechanisms of authentication.
The most secured of these is what we call
the one-time use password.
These are implemented generally using either
a time-based or a hash-based mechanism.
Now, with a Time-based One-Time use Password,
or a TOTP,
a password is computed from
a shared secret and a current time.
This is often used with RSA key fobs,
where they create a seemingly random number
that's displayed on this ownership factor,
and then you're going to type that in
and the server and the client both would know it,
but nobody else will.
And since these passwords are constantly
changing every 30 or 60 seconds,
they can only be used one time
before they start changing again.
Now, this time-based approach is actually a variation
of the hash-based approach
known as the HMAC-based One Time
Password algorithm or HOTP.
This algorithm actually computes a password
from a shared secret
and it's synchronized
across both the client and the server.
Each time that password is entered in to log in,
a new password is created
using this hash-based algorithm
and it's synchronized between the client
and the server, making sure that it's only used one time.
As you can see,
there are a lot of ways to conduct authentication.
In this section of the course,
we're going to focus exclusively on authentication,
the different technologies
and the different mechanisms that are used.