1. CSCE 201 Identification and Authentication Fall 2015

2. CSCE 201 - Farkas2 Required reading list: – An Introduction to Computer Security: The NIST Handbook, http://csrc.nist.gov/publications/nistpubs/800-12/handbook.pdf : Chapter 16, IDENTIFICATION AND AUTHENTICATION, pages 180-192 http://csrc.nist.gov/publications/nistpubs/800-12/handbook.pdf Recommended: – Biometrics, from Wikipedia, the free encyclopedia, http://en.wikipedia.org/wiki/Biometrics http://en.wikipedia.org/wiki/Biometrics – John the Ripper password cracker http://www.openwall.com/john/ http://www.openwall.com/john/ – Brutus the remote password cracker http://www.hoobie.net/brutus/ http://www.hoobie.net/brutus/

3. CSCE 201 - Farkas3

4. 4 Identification Something you know Something you own Who you are What you are Where you are

5. CSCE 201 - Farkas5 Identification Allows an entity (a user or a system) to prove its identity to another entity Typically, the entity whose identity is verified reveals knowledge of some secret S to the verifier Strong authentication: the entity reveals knowledge of S to the verifier without revealing S to the verifier

6. CSCE 201 - Farkas6 Identification Information Must be securely maintained by the system.

7. CSCE 201 - Farkas7 Authentication Authentication mechanism: verifies the identification information Access control mechanism: grant privileges upon successful authentication Logging: record security relevant events in an audit trail

8. CSCE 201 - Farkas8 Authentication Requirements Network must ensure – Data exchange is established with addressed peer entity not with an entity that masquerades or replays previous messages Network must ensure data source is the one claimed

9. CSCE 201 - Farkas9 Passwords Commonly used method For each user, system stores (user name, F(password)), where F is some transformation (e.g., one-way hash) in a password file – F(password) is easy to compute – From F(password), password is difficult to compute – Password is not stored in the system When user enters the password, system computes F(password); match provides proof of identity

10. CSCE 201 - Farkas10 Vulnerabilities of Passwords Inherent vulnerabilities – Easy to guess or snoop – No control on sharing Practical vulnerabilities – Visible if unencrypted in distributed and network environment – Susceptible for replay attacks if encrypted naively Password advantage – Easy to modify compromised password.

11. CSCE 201 - Farkas11 Attacks on Password Guessing attack/dictionary attack Social Engineering Sniffing Trojan login Van Eck sniffing

12. CSCE 201 - Farkas12 Social Engineering Attacker asks for password by masquerading as somebody else (not necessarily an authenticated user) May be difficult to detect Protection against social engineering: strict security policy and users’ education

13. CSCE 201 - Farkas13 Password Management Policy Educate users to make better choices Define rules for good password selection and ask users to follow them Ask or force users to change their password periodically Actively attempt to break user’s passwords and force users to change broken ones Screen password choices

14. CSCE 201 - Farkas14 One-time Password Use the password exactly once!

15. CSCE 201 - Farkas15 Time Synchronized There is a hand-held authenticator – It contains an internal clock, a secret key, and a display – Display outputs a function of the current time and the key – It changes about once per minute User supplies the user id and the display value Host uses the secret key, the function and its clock to calculate the expected output Login is valid if the values match

16. CSCE 201 - Farkas16 Time Synchronized Secret key Time One Time Password Encryption

17. CSCE 201 - Farkas17 Challenge Response Work station Host Network Non-repeating challenges from the host is used The device requires a keypad User ID Challenge Response

18. CSCE 201 - Farkas18 Challenge Response Secret key Challenge One Time Password Encryption

19. CSCE 201 - Farkas19 Devices with Personal Identification Number (PIN) Devices are subject to theft, some devices require PIN (something the user knows) PIN is used by the device to authenticate the user Problems with challenge/response schemes – Key database is extremely sensitive – This can be avoided if public key algorithms are used

20. CSCE 201 - Farkas20 Smart Cards Portable devices with a CPU, I/O ports, and some nonvolatile memory Can carry out computation required by public key algorithms and transmit directly to the host Some use biometrics data about the user instead of the PIN

21. CSCE 201 - Farkas21 Biometrics Fingerprint Retina scan Voice pattern Signature Typing style

22. CSCE 201 - Farkas22 Problems with Biometrics Expensive – Retina scan (min. cost) about $ 2,200 – Voice (min. cost) about $ 1,500 – Signature (min. cost) about $ 1,000 False readings – Retina scan 1/10,000,000+ – Signature 1/50 – Fingerprint 1/500 Can’t be modified when compromised

23. CSCE 201 - Farkas23 Home Computer Security

24. CSCE 201 - Farkas24 Problem: You don’t remember your password Solutions: 1. Verify that you have typed the letters of your password in the correct case 2. Access a password hint on the Welcome screen 3. Use a password reset disk 4. Log on as administrator to assign a new password to your account

25. CSCE 201 - Farkas25 Password Case Sensitivity Check CAPS LOCK key Question: Why do you want to use combination of symbols for your password?

26. CSCE 201 - Farkas26 Using the Password Reset Disk Create a password reset disk for your user account at the earliest opportunity How to use the password reset disk – Microsoft Windows remembers if you have created a password reset disk. Just click use your password reset disk – Follow the instructions of the Password Reset Wizard Question: Why should you safeguard your password reset disk?

27. CSCE 201 - Farkas27 Use a Password Hint Create a password hint: – Log on to your computer – Click Start, and then click Control Panel – Double-click User Accounts – Click your user account, and then click Change my password – Enter your current password, enter a new password, and then enter the new password again to confirm it – Enter the password hint, and then click Change Password – The change will take effect the next time that you log on To display the hint, click the question mark (?) that is next to your user account

28. CSCE 201 - Farkas28 Create a Password Reset Disk Click Start, and then click Control Panel Double-click User Accounts Click your user account, and then click Prevent a forgotten password. The Forgotten Password Wizard starts Follow the instructions NOTE: A password reset disk is valid until you create a new one; even if you change your password

29. CSCE 201 - Farkas29 Next Class Cyber stalking, Fraud and Abuse