Enterprise Information Security: System Access Concepts - Authentication & Authorization, Exams of Advanced Education

Download Enterprise Information Security: System Access Concepts - Authentication & Authorization and more Exams Advanced Education in PDF only on Docsity!

ITM 825 Enterprise Information Security

Toronto Metropolitan University

ITM 825 - Lecture 07

Dr. Atty Mashatan

2

Authorization

Password-based

A widely used line of defense against intruders is a password system Virtually all multiuser systems, network-based servers, web- based ecommerce sites, and other similar services require that a user provide not only a name or identifier (ID) but also a password The ID provides security in the following ways:

• The ID determines whether the user is authorized to gain access to a system
• The ID determines the privileges accorded to the user
• The ID used in what is referred to as discretionary access control (by

listing the IDs of the other users, a user may grant permission to

them to read files owned by that user)

• Password guessing against a single user
  • An attacker may attempt to gain knowledge about an account holder and system password policies and uses that knowledge to guess the user’s password
  • Countermeasures include training in and enforcement of password policies that make passwords difficult to guess. Such policies address the secrecy, minimum length of the password, character set, prohibition against using well- known user identifiers, and length of time before the password must be changed
• Workstation hijacking
  • In this type of attack, an attacker waits until a logged-in workstation is physically unattended
  • The standard countermeasure is automatically logging out the workstation after a period of inactivity. Intrusion detection schemes are used to detect changes in user behavior
• Exploiting user mistakes
  • If the system assigns a password, then the user is more likely to write it down because it is difficult to remember. This situation creates the potential for an adversary to read the written password. A user may intentionally share a password to enable a colleague to share files, for example. Also, attackers are frequently successful in obtaining passwords by using social engineering tactics that trick the user or an account manager into revealing a password. Many computer systems are shipped with preconfigured passwords for system administrators. Unless these preconfigured passwords are changed, they are easily guessed
  • Countermeasures include user training, intrusion detection, and simpler passwords combined with another

authentication mechanism

Password Vulnerability

Despite many security vulnerabilities, passwords remain the most commonly used user authentication technique Reasons for the persistent popularity of passwords are: Techniques that utilize client- side hardware, such as fingerprint scanners and smart card readers, require the implementation of the appropriate user authentication software to exploit this hardware on both the client and server systems Physical tokens, such as smart cards, are expensive and/or inconvenient to carry around, especially if multiple tokens are needed Schemes that rely on a single sign- on to multiple services create a single point of security risk Automated password managers that relieve users of the burden of knowing and entering passwords have poor support for roaming and synchronization across multiple client platforms, and their usability had not been adequately researched

Salt

**-

slow hash function** User ID Salt Hash code Load Password Password File (a) Loading a new password Password File User id User ID Salt Hash code Select Salt Hashed password (b) Verifying a password Figure 10.4 UNIX Password Scheme Compare Password slow hash function