2.4 Authentication & Authorization

Question 1

Define Federation

Answer 1

Using a third-party to provide authentication and then trusting that authentication

Question 2

Define Attestation

Answer 2

Verifying that the hardware being used to connect to your network is the hardware provided to the user

Question 3

Define TOTP for authentication

Answer 3

Time-based One Time Password - a numeric token is generated every x seconds that must be provided when logging in
Examples RSA Key Fob or Google Authenticator

Question 4

Define HOTP for authentication

Answer 4

HMAC-based One Time Password - similar to TOTP, the number comes from a pre-generated list of numbers and each one is only used once

Question 5

Define SMS authentication and vulnerability

Answer 5

A code is sent via text message that is provided to login, SMS messages are vulnerable to interception or a device can easily impersonate another device to receive the code

Question 6

Define static codes authentication

Answer 6

A static code, i.e. password or PIN is used to authenticate

Question 7

Define authentication applications (2 examples)

Answer 7

Applications that assist with providing login codes, such as an application that tells you the next code when using HMAC-based One Time Passwords for login
OR application that receives push-notifications you must respond to in order to login

Question 8

Define Push-Notifications authentication and vulnerability

Answer 8

1. An application is installed on a device that receives push-notifications when logging in (i.e. our GSPN login at work)
2. Can be a vulnerability if the notifications are not strongly encrypted but generally more secure than SMS or phone call authentication.

Question 9

Define Phone call authentication and vulnerability

Answer 9

1. When logging in, the user receives a phone call with an access code that must be provided
2. Same weaknesses as SMS authentication since phone numbers can be easily spoofed

Question 10

Define Smart Card authentication

Answer 10

A card using either a chip, RFID, or NFC, and containing a certificate used to login. Usually in conjunction with other authentication methods

Question 11

How are biometrics used for authentication?

Answer 11

Various biometric features, such face, gait, retina, veins, are unique to each of us and can be analyzed to prove identity

Question 12

Define False Acceptance Rate (FAR) relative to biometric authentication

Answer 12

allowing when person should be denied

Question 13

How can False Acceptance Rate (FAR) be reduced?

Answer 13

By increasing the sensitivity of the biometric reader

Question 14

Define False Rejection Rate (FRR) relative to biometric authentication

Answer 14

denying a user who should be allowed

Question 15

How can False Rejection Rate (FRR) be remedied?

Answer 15

By decreasing the sensitivity of the biometric reader

Question 16

Define Crossover Error Rate (CER) relative to biometric authentication

Answer 16

the ideal spot where sensitivity and error rates meet to create the desired level of security

Question 17

Define MFA

Answer 17

Multi-factor Authentication

Question 18

Define 3 Factors of MFA

Answer 18

1. Something you know
2. Something you have
3. Something you are

Question 19

2 Examples of Something you Know

Answer 19

Password, PIN

Question 20

3 Examples of Something you Have

Answer 20

1. Smart card
2. token on USB thumb-drive
3. phone to receive code via SMS or voice call

Question 21

Example of Something you Are

Answer 21

Biometrics

Question 22

Define 4 Attributes of MFA

Answer 22

1. Somewhere you are
2. Something you can do
3. Something you exhibit
4. Someone you know

Question 23

Example of somewhere you are

Answer 23

Geographic location, such as country, state, city

Question 24

Example of something you can do

Answer 24

Signature

Question 25

Example of something you exhibit

Answer 25

Way you walk aka gait

Question 26

Example of someone you know

Answer 26

Digital signature or certificates

Question 27

Define AAA

Answer 27

Authentication, Authorization, Accounting

Question 28

Define Authentication

Answer 28

proving your identity

Question 29

Define Authorization

Answer 29

whether or not you have access to something

Question 30

Define Accounting

Answer 30

logging who has logged in and what has been accessed

Question 31

2 Models (locations) to provide AAA

Answer 31

Cloud-based or on-premises