Domain 5

Domain 5 - Identity and Asset Management

Brute force attacks
- use key stretching
Dictionary attacks
- limit number of logins
- do not allow dictionary words
Rainbow tables
- limit number of logins (salts)
Key logger
Clipping levels
- to prevent administrative overhead
- allow failed attempts (only 3-4)
- block the account for an amount of time
Microsoft Defaults:
- password history: set to 24
- max age: 90 days
- min age: 2 days
- min length: 8 chars
- complexity
- store password using irreversible encryption

fingerprint
facial geometry
biological characteristics
behavioral characteristics
- keystrokes dynamics
- signature dynamics
FRR (type-1 error)
- False Rejection Rate
- valid subject denied
FAR (type-2 error)
- False Acceptance Rate
- invalid subject allowed
Point when FRR and FAR are equal, is the CER (Crossover Error Rate)
Issues
- biometrics are easily to get / find out
- attackers can take pictures
- how you type can be replayed

centralized
- Pros
  - all systems and location have the same
  - security posture
  - easier to manage
  - only few have access
  - provides separation of duties
  - SSO can be used
- Cons
  - Traffic overhead and response time
  - is connectivity to head office stable?
Identity and access provisioning lifecycle
- User access review
- System account access review
- Provisioning and Deprovisioning
Accounts can have too much access (excessive privilege)
Accounts can have inherited privilege (privilege creep)

extends IM from a single organization to multiple organization whishing to share identities between themselves.
pros
- ease of account management
- single-sign-on
- increased productivity (because staff has to remember just one login and can use SSO)
cons
- doesn’t prevent brute-force attacks
SSO
- OAuth, OpenID, Shibboleth, Kerberos, Active Directory Federation Services (ADFS), Central Authentication Services (CAS)
SAML
- XML
- webbased SSO
- to secure SAML against eavesdropping or forged assertions use TLS with dig signatures

mutual authentication
client-server model
protected against eavesdropping and replay attacks
build on symmetric keys
uses realms
KDC - Key Distribution Center
- trusted third party that provides authentication services. Maintains the secret keys for all registered entities.
Authentication Server
- verifies and accepts/rejects tickets based on authenticity and timeliness
Ticket Granting Server
- issues tickets to authorized users
Ticket
- an encrypted message that provides some form or type of proof depending on what type of ticket it is.
  - Ticket-Granting Ticket
  - Service Ticket
Concerns
- security depends on careful implementation
- enforcing limited lifetimes for authentication, minimize the threats of replayed credentials
- KDC must be physically secured and protected
- KDC can be a SPoF, and therefore must be considered in backup plan and BCP
- length of the keys (secret and session) is very important
  - too short
    - brute-force attacks
  - too long
    - system can be overloaded
- encryption processes are based on passwords
  - password-guessing attacks