4 Securing Secure the hardware –Lock the server room and other ways to get access to the hardware. –Password protect the BIOS-setup Secure the NOS.

Slides:

Advertisements

Similar presentations

Overview Network security involves protecting a host (or a group of hosts) connected to a network Many of the same problems as with stand-alone computer.

Advertisements

Security Protocols Sathish Vadhiyar Sources / Credits: Kerberos web pages and documents contained / pointed.

Windows 2000 Security --Kerberos COSC513 Project Sihua Xu June 13, 2014.

Kerberos 1 Public domain image of Heracles and Cerberus. From an Attic bilingual amphora, 530–520 BC. From Italy (?).

Authenticating Users. Objectives Explain why authentication is a critical aspect of network security Explain why firewalls authenticate and how they identify.

Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown.

Module 6: Configuring Windows XP Professional to Operate in a Microsoft Network.

Chapter 14 From Cryptography and Network Security Fourth Edition written by William Stallings, and Lecture slides by Lawrie Brown, the Australian Defence.

Authentication & Kerberos

Cryptography and Network Security Chapter 15 Fifth Edition by William Stallings Lecture slides by Lawrie Brown.

Kerberos Authentication for Multi-organization Cross-Realm Kerberos Authentication User sent request to local Authentication Server Local AS shares cross-realm.

Security at the Operating System Level (Microsoft) By Birinder Dhillon.

ISA 3200 NETWORK SECURITY Chapter 10: Authenticating Users.

KerberSim CMPT 495 Fall 2004 Jerry Frederick. Project Goals Become familiar with Kerberos flow Create a simple Kerberos simulation.

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. 10 Authenticating Users By Whitman, Mattord, & Austin© 2008 Course Technology.

Database Security and Auditing: Protecting Data Integrity and Accessibility Chapter 2 Operating System Security Fundamentals.

Windows 2000 Security Architecture Peter Brundrett Program Manager Windows 2000 Security Microsoft Corporation.

SSH Secure Login Connections over the Internet

Dr. John P. Abraham Professor UTPA.  Particularly attacks university computers  Primarily originating from Korea, China, India, Japan, Iran and Taiwan.

Windows Security Mechanisms Al Bento - University of Baltimore.

MS systems use one of the following: LanManager Hash (LM) LanManager Hash (LM) NT LanManager (NTLM) NT LanManager (NTLM) Cached passwords Cached passwords.

Mario Čagalj Sveučilište u Splitu 2013/2014. Sigurnost računala i podataka.

Users and Groups Security Architecture Editing Security Policies The Registry File Security Auditing/Logging Network Issues (client firewall, IPSec, Active.

Ins and Outs of Authenticating Users Requests to IIS 6.0 and ASP.NET Chris Adams Program Manager IIS Product Unit Microsoft Corporation.

Slide Master Layout Useful for revisions and projector test  First-level bullet  Second levels  Third level  Fourth level  Fifth level  Drop body.

Chapter 4 Windows NT/2000 Overview. NT Concepts  Domains –A group of one or more NT machines that share an authentication database (SAM) –Single sign-on.

Windows This presentation is an amalgam of presentations by Mark Michael, Randy Marchany and Ed Skoudis. I have edited and added material. Dr. Stephen.

70-294: MCSE Guide to Microsoft Windows Server 2003 Active Directory Chapter 9: Active Directory Authentication and Security.

70-270: MCSE Guide to Microsoft Windows XP Professional Second Edition, Enhanced Chapter 6: Windows XP Security and Access Controls.

Windows Operating System Internals - by David A. Solomon and Mark E. Russinovich with Andreas Polze Unit OS7: Security 7.2. Windows Security Components.

IS 302: Information Security and Trust Week 7: User Authentication (part I) 2012.

Group 11 CSE 8343 Group 1 Windows 2000 Domain Security & Authentication.

Authenticating Users Chapter 6. Learning Objectives Understand why authentication is a critical aspect of network security Describe why firewalls authenticate.

Chapter Six Windows XP Security and Access Controls.

CIS 450 – Network Security Chapter 8 – Password Security.

Configuring Encryption and Advanced Auditing

Windows Security. Security Windows 2000/XP Professional security oriented Authentication Authorization Internet Connection Firewall.

SSL, Single Sign On, and External Authentication Presented By Jeff Kelley April 12, 2005.

Designing Authentication for a Microsoft Windows 2000 Network Designing Authentication in a Microsoft Windows 2000 Network Designing Kerberos Authentication.

Module 5 Configuring Authentication. Module Overview Lesson 1: Understanding Classic SharePoint Authentication Providers Lesson 2: Understanding Federated.

Breno de MedeirosFlorida State University Fall 2005 Windows servers The NT security model.

Windows NT ® Single Sign On Cross Platform Applications (Part II) John Brezak Program Manager Windows NT Security Microsoft Corporation.

Mastering Windows Network Forensics and Investigation Chapter 13: Logon and Account Logon Events.

Kerberos Named after a mythological three-headed dog that guards the underworld of Hades, Kerberos is a network authentication protocol that was designed.

Module 8: Designing Security for Authentication. Overview Creating a Security Plan for Authentication Creating a Design for Security of Authentication.

Operating System Security Fundamentals Dr. Gabriel.

Guide to MCSE , Second Edition, Enhanced1 The Windows XP Security Model User must logon with: Valid user ID Password User receives access token Access.

Ins and Outs of Authenticating Users Requests to IIS 6.0 and ASP.NET Chris Adams Program Manager IIS Product Unit Microsoft Corporation.

Windows Operating System Internals - by David A. Solomon and Mark E. Russinovich with Andreas Polze Unit OS7: Security 7.1. The Security Problem.

Windows 2000 Security Yingzi Jin. Introduction n Active Directory n Group Policy n Encrypting File System.

Module 2: Introducing Windows 2000 Security. Overview Introducing Security Features in Active Directory Authenticating User Accounts Securing Access to.

COEN 351 Authentication. Authentication is based on What you know Passwords, Pins, Answers to questions, … What you have (Physical) keys, tokens, smart-card.

User Authentication  fundamental security building block basis of access control & user accountability  is the process of verifying an identity claimed.

Introduction to Microsoft Windows 2000 Security Microsoft Windows 2000 Security Services Overview Security subsystem components Local security authority.

KERBEROS SYSTEM Kumar Madugula.

CSCI 530 Lab Passwords. Overview Authentication Passwords Hashing Breaking Passwords Dictionary Hybrid Brute-Force Rainbow Tables Detection.

LM/NTLMv1 Retirement Hosted by LSP Services.

© 2015 Pearson Education Ltd. Chapter 5 Chapter 5.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

#SummitNow Alfresco Authentication and Synchronization Nov 2013 Mark Rogers.

Enabling Secure Internet Access with TMG

Radius, LDAP, Radius used in Authenticating Users

Kerberos Kerberos is a network authentication protocol and it is designed to provide strong authentication for client server applications. It uses secret.

Florida State University

Kerberos Kerberos Ticket.

(Authentication / Authorization)

Presentation transcript:

4 Securing Secure the hardware –Lock the server room and other ways to get access to the hardware. –Password protect the BIOS-setup Secure the NOS

Windows EFS NTFS can be encrypted (EFS) with File Encryption Key (FEK) Encrypting File Recovery Agents (Selected Users) are able to recover FEKs. [Additional users are added by editing EFS recovery policy]

Windows-Authentication Two functions: –Verify a user’s credentials (Username and password). –Provide access to resources. GINA (Graphical Identification and Authentication) Basic Authentication External Authentication –Biometrics/Smartcard/Tokenbased Kerberos

GINA (Graphical Identification and Authentication) Winlogon process GINA Ctrl+Alt+Del Secure Attention Sequence (SAS) Username Password LSA Local Security Authority LPC Local Procedure Call SSPI Security Support Provider Interface Default SSP (Security Service Provider) Kerberos (2003) Next SSP NTLM (NT LAN Manager) SAM Result

Basic Authentication LanManager (LM) and NTLM Challenge/Response (DOS/W3.11/W95/W98/->NT4sp3) Challenge/Response Password (max 14char) Hash (Oneway) Key 2x7byte Random string Encrypt Decrypt Key LMResponse =? Encrypt Decrypt NTLM Response

Basic NTLMv2 NTLMv2 Challenge/Response NT4sp4-> Challenge/Response Password Hash MD5 Key 128bits Random string EncryptDecrypt Key Response =?

External: Biometrics (Fingerprint, eye) Smartcard (Reader for smartcard) RSA SecureID Tokens (Internetpayment)

Kerberos Developed at MIT ~1980 (Massachusetts Institute of Technology) Secure authentication protocol –Uses Public key encryption Ticket Granting (Only one authentication needed) Kerberos supports proxy and forwarding of credentials. Uses NTP (Network Time Protocol) for synchronization. Used in: –W2K3-server –W2000 environment –Active Directory –Windows XP –Stored in AD and generate keys automatically. –Compatible with MIT Kerberos implementation for Unix

Authorization 1.Network login 2.Call to server Authentication server Client Server 1 Login Login Call 2 Authorization

Ticket serverKerberos Authentication server (Public key) Client (Private-key) Server Privilege server PS Login Call

Ticket serverKerberos 1.Network login Authentication server (Public key) Client (Private-key) Server Privilege server PS 1 Login Login Call

Ticket serverKerberos 1.Network login 2.TGT Ticket Granting Ticket Encrypted with Public key Authentication server (Public key) Client (Private-key) Server Privilege server PS 1 Login 2 TGT Login Call

Ticket serverKerberos 1.Network login 2.TGT Ticket Granting Ticket Encrypted with Public key 3TGT -> TGT for PS Authentication server (Public key) Client (Private-key) Server Privilege server PS 1 Login 2 TGT 3 TGT Login Call

Ticket serverKerberos 1.Network login 2.TGT Ticket Granting Ticket Encrypted with Public key 3,4TGT -> TGT for PS Authentication server (Public key) Client (Private-key) Server Privilege server PS 1 Login 2 TGT 4 TGT(PS) 3 TGT Login Call

Ticket serverKerberos 1.Network login 2.TGT Ticket Granting Ticket Encrypted with Public key 3,4TGT -> TGT for PS 5TGT(PS) 6,7 ->8 PrivilegeTGT Authentication server (Public key) Client (Private-key) Server Privilege server PS 1 Login 2 TGT 5 TGT (PS) 4 TGT(PS) 3 TGT Login Call

Ticket serverKerberos 1.Network login 2.TGT Ticket Granting Ticket Encrypted with Public key 3,4TGT -> TGT for PS 5TGT(PS) 6,7 ->8 PrivilegeTGT Authentication server (Public key) Client (Private-key) Server Privilege server PS 1 Login 2 TGT 5 TGT (PS) 4 TGT(PS) 3 TGT 6 Login Call

Ticket serverKerberos 1.Network login 2.TGT Ticket Granting Ticket Encrypted with Public key 3,4TGT -> TGT for PS 5TGT(PS) 6,7 ->8 PrivilegeTGT Authentication server (Public key) Client (Private-key) Server Privilege server PS 1 Login 2 TGT 5 TGT (PS) 4 TGT(PS) 3 TGT 6 7 Login Call

Ticket serverKerberos 1.Network login 2.TGT Ticket Granting Ticket Encrypted with Public key 3,4TGT -> TGT for PS 5TGT(PS) 6,7 ->8 PrivilegeTGT (’user id’+’Group id’ keep entire session) Authentication server (Public key) Client (Private-key) Server Privilege server PS 1 Login 2 TGT 5 TGT (PS) 4 TGT(PS) 3 TGT PTGT Login Call

Ticket serverKerberos 1.Network login 2.TGT Ticket Granting Ticket Encrypted with Public key 3,4TGT -> TGT for PS 5TGT(PS) 6,7 ->8 PrivilegeTGT (’user id’+’Group id’ keep entire session) 9PTGT -> Ticket Authentication server (Public key) Client (Private-key) Server Privilege server PS 1 Login 2 TGT 5 TGT (PS) 4 TGT(PS) 3 TGT 9 PTGT PTGT Login Call

Ticket serverKerberos 1.Network login 2.TGT Ticket Granting Ticket Encrypted with Public key 3,4TGT -> TGT for PS 5TGT(PS) 6,7 ->8 PrivilegeTGT (’user id’+’Group id’ keep entire session) 9,10PTGT -> Ticket Authentication server (Public key) Client (Private-key) Server Privilege server PS 1 Login 2 TGT 5 TGT (PS) 4 TGT(PS) 3 TGT 9 PTGT 10 Ticket PTGT Login Call

Ticket serverKerberos 1.Network login 2.TGT Ticket Granting Ticket Encrypted with Public key 3,4TGT -> TGT for PS 5TGT(PS) 6,7 ->8 PrivilegeTGT (’user id’+’Group id’ keep entire session 9,10PTGT -> Ticket 11Ticket to server Authentication server (Public key) Client (Private-key) Server Privilege server PS 1 Login 2 TGT 5 TGT (PS) 4 TGT(PS) 3 TGT 9 PTGT 10 Ticket Ticket 8 PTGT Login Call

Ticket serverKerberos 9,10PTGT -> Ticket 11Ticket to server Authentication server (Public key) Client (Private-key) Server Privilege server PS 9 PTGT 10 Ticket 11 Ticket Login Call

Ticket serverKerberos 9,10PTGT -> Ticket 11Ticket to server Client (Private-key) Server 9 PTGT 10 Ticket 11 Ticket Call

Ticket serverKerberos 1.Network login 2.TGT Ticket Granting Ticket Encrypted with Public key 3,4TGT -> TGT for PS 5TGT(PS) 6,7 ->8 PrivilegeTGT (’user id’+’Group id’ keep entire session 9,10PTGT -> Ticket 11Ticket to server Authentication server (Public key) Client (Private-key) Server Privilege server PS 1 Login 2 TGT 5 TGT (PS) 4 TGT(PS) 3 TGT 9 PTGT 10 Ticket Ticket 8 PTGT Login Call