Chapter 10 (Authentication)
Terms in this set (49)
What is Mutual Authentication?
Authentication scheme that involves both sides of the communication authenticating.
What are the authentication factors?
-Something you know
-Something you have
-Something you are
-Somewhere you are
-Something you do
What is Single Sign-on (SSO)?
he principle that when you authenticate with each different system you access- you authenticate once and then can gain access to multiple systems without authenticating again.
Why is SSO valuable?
The user logs on with one set of credentials and then accesses many different servers, even servers in other organizations.
What is Identity Federation?
Authenticating against an identity store in your organization and being authorized to use network services from other organizations.
What is the disadvantage of SSO?
If the hacker gets access to an account that uses SSO, they can access all of the servers that the account is authorized to.
What is an Access token used for?
used to determine whether a user should be allowed to access a resource or to perform an operating system task.
What information does a token maintain?
Group Security identifier
Primary group security identifier
What is a authentication protocol?
determines how the authentication information is passed from the client to the server.
What are the authentication methods used in microsoft?
Integrated windows authentication
What is Kerberos?
A popular mutual authentication protocol and is used by default with active directory environments.
How does kerberos authentication work?
1. Client logs onto the network.
2. The Authentication server provides the client with a ticket-granting ticket.
3. The client can then request service from a server on the network.
4. Before getting access, the TGS needs to grant the ticket to the client so the client can access the required server on the network.
What is LDAP?
Lightweight directory access protocol standard is the internet protocol for accessing and querying a directory. Mostly used in Microsoft active directory.
What does KDC do?
It's responsible for issuing tickets.
What is RAS?
Remote access service is a remote access technology that supports point to point connections using PPP as the remote access protocol used by a telephony applications to connect to the ras server.
What are the authentication protocols used by VPN and RAS?
Password Authentication protocol (PAP)
Challenge handshake authentication protocol (CHAP)
Microsoft challenge handshake authentication protocol (MS-CHAP)
Extensible Authentication Protocol
What is PAP?
An authentication protocol in which the client authenticates itself to a server by passing the user name and password to it. The server then compares this information to its password store. Because the password is passed in clear text, this is not recommended in an environment where security concerns are an issue
What is Challenge handshake authentication Protocol (CHAP)?
An authentication protocol that uses an encryption algorithm to pass the authentication data to protect it from hackers. Because CHAP is so much more secure than PAP, it is used widely today on the Internet.
What is the steps performed by CHAP?
1. The server sends the client a challenge (a key)
2. The client then combines the challenge with the password. Both the users password and the challenge are run through the MD 5 hashing algorithm, which generates a has value, or mathematical answer. The hash value is sent to the server for authentication.
3. The server uses the same key to create a hash value with the password stored on the server and then compares the resulting value with the hash value sent by the client. If the two hash values are the same, the client has supplied the correct password. The benefit is that the users credentials have not been passed across the network at all.
What is Microsoft challenge handshake authentication protocol?
A form of the Challenge Handshake Authentication Protocol. It uses the same type of encryption methodology as the parent protocol, but is slightly more secure. The server sends a challenge to the originating host, which must return the user name and an MD-4 hash of the challenge string, the session ID, and the MD-4 hashed password.
What is MS-CHAPv2?
The authentication method has been extended to authenticate both the client and the server. MS-CHAPv2 also uses stronger encryption keys than CHAP and MS-CHAP.
What is Extensible authentication protocol?
It allows for multiple logon methods such as smartcard logon, certificates, kerberos, and public- key authentication. EAP is also frequently used with RADIUS, which is a central authentication service that can be used by RAS, wireless, or VPN solutions.
What is AAA?
Authentication, authorization, and Accounting
What are the AAA services?
Radius, Diameter, and TACACS+
What is Radius?
Radius is a central authentication service that has been popular for many years.
What transport protocol does Radius use?
What UDP ports does Radius use?
UDP port 1812 for authentication and authorization serivices
UDP port 1813 for accounting services
What is diameter?
A newer AAA protocol and is designed to replace Radius. D
Why was Radius replaced with Diameter?
Provides more reliable communication than radius because it is TCP based. Diameter has improved upon the services being offered over radius by being a more secure, scalable protocol.
What does TACACS stand for?
Terminal Access controller access control system
What is TACACS used for?
It's used as an authentication service that ran on Unix system.
What Ports and Transport protocol does TACACS use?
TCP and UDP
What is TACACS+?
AAA protocol used by cisco networks and supersedes the original TACACS and XTACACS protocols.
What transport protocol and ports does TACACS+ use?
Transport port: TCP
What are other authentication protocols?
What is Secure LDAP?
Secure Ldap is the LDAP protocol using SSL over TCP port 636 to encrypt the communication between the client and LDAP system.
What is SAML?
Security Assertion Markup Language is an XML standard that is designed to allow systems to exchange authentication and authorization information. This is often used with identity federation.
What is TOTP?
Time-based one time password is an algorithm used by authentication systems that involves passwords being generated based on the current time.
What is HOTP?
HMAC- based one time password is an HMAC based algorithm used to generate passwords.
What is Implicit deny?
A security concept that relates to authentication by denying anyone access to a system until they are authenticated.
What is Trusted OS?
A term used to identify a system that implements multiple layer of security such as authentication and authorization to determine who can access a system and what they can do.
What is Federation?
A term used to authenticate and authorize users across organizations and application boundaries.
What is Transitive Trust?
The term associated with allowing access based on a trust model.
What are the common methods to implement authentication?
User accounts, access tokens, and biometrics.
What is the difference between identification and authentication?
Idenitification is presenting identifying information such as a username, while authentication is proving you are that person.
What are three major types of token?
Hardware token, Software token, and Logical Token.
What is Bio-metrics?
the process of authenticating to a system or network by using a physical characteristic of yourself such as a fingerprint, retina scan, or voice recognition.
What is Logical Token?
The token that is generated at logon that contains the user SID, groups SIDs, the privileges the of the user.
What happens in a bio-metric enrollment process?
The bio-metric data is read off of a bio-metric reader.
2. The bio-metric data is converted to a digital representation.
3. The bio-metric data is then run through a mathematical operation, and the results of that operation are stored in a database in a database for authentication to the system.