© ITT Educational Services, Inc. All rights reserved. IS3230 Access Security Unit 7 Authentication Methods and Requirements

© ITT Educational Services, Inc. All rights reserved.Page 2 IS3230 Access Security Class Agenda 10/29/15 Chapter 10 Learning Objectives Lesson Presentation and Discussions. Quiz 3 will be held today. Lab Activities will be performed in class. Assignments will be given in class. Break Times. 10 Minutes break in every 1 Hour. Note: All Assignment and labs due today.

© ITT Educational Services, Inc. All rights reserved.Page 3 IS3230 Access Security Learning Objective  Design appropriate authentication solutions throughout an information technology (IT) infrastructure based on user types and data classification standards.

© ITT Educational Services, Inc. All rights reserved.Page 4 IS3230 Access Security Key Concepts  Different users and their authentication requirements  Remote Authentication Dial In User Service (RADIUS) and Terminal Access Controller Access Control System Plus (TACACS+) authentication server deployments  Multi-factor authentication  Authentication requirements for the Institute of Electrical and Electronics Engineers (IEEE) wireless local area networks (WLANs) infrastructure  Best practices for private and public sector authentication

© ITT Educational Services, Inc. All rights reserved.Page 5 IS3230 Access Security Access Control Lists Set of permissions attached to an object Specifies which subjects may access the object and what operations they can perform ACLs usually viewed in relation to operating system files Security+ Guide to Network Security Fundamentals, Fourth Edition 5

© ITT Educational Services, Inc. All rights reserved.Page 6 IS3230 Access Security Do they need special permissions? What tools will they need? What applications and data do they want? Who are my customers? From where are they accessing the network? Has the data been classified and made available? How will the risks be managed? User Access Considerations

© ITT Educational Services, Inc. All rights reserved.Page 7 IS3230 Access Security User Types and Potential Access Considerations Types of UsersAuthentication Methods Remote User  Virtual Private Networks (VPNs)  Secure Browser Secure Shell (SSH)  Internet Protocol Security (IPSec)  Citrix  Remote Desktop Protocol (RDP) Local User  Access Credentials Web Customer  Secure Browser Secure Sockets Layer (SSL)  Secure Extra Net Data Classification and Least Privilege are essential to all access methods

© ITT Educational Services, Inc. All rights reserved.Page 8 IS3230 Access Security User Types and Potential Access Considerations (Continued) Types of UsersAuthentication Methods Wireless User  Secure Channel–VPN  Secure Browser–SSL Dial-In User  VPN and Wireless Fidelity (Wi-Fi)  Encryption and Citrix Business-to- Business (B2B) Customer  Secure Browser  Secure File System Access Method Data Classification and Least Privilege are essential to all access methods

© ITT Educational Services, Inc. All rights reserved.Page 9 IS3230 Access Security Discussion

© ITT Educational Services, Inc. All rights reserved.Page 10 IS3230 Access Security Security+ Guide to Network Security Fundamentals, Fourth Edition 10 Table 9-3 Access control models

© ITT Educational Services, Inc. All rights reserved.Page 11 IS3230 Access Security Access Control Models Standards that provide a predefined framework for hardware or software developers Four major access control models Mandatory Access Control (MAC)-Policy defined by system Discretionary Access Control (DAC)-Policy defined by owner Role Based Access Control (RBAC)-Policy defined by user function Rule Based Access Control (RBAC)-Policy defined by Rules Security+ Guide to Network Security Fundamentals, Fourth Edition 11

© ITT Educational Services, Inc. All rights reserved.Page 12 IS3230 Access Security Multi-Factor Authentication Combination of authentication concepts (something you know, something you have, and something you are) to form two- or three-factor authentication methods:  Increases security  Decreases the likelihood of compromising a user’s credentials

© ITT Educational Services, Inc. All rights reserved.Page 13 IS3230 Access Security Multi-Factor Authentication Examples  Bank automated teller machine (ATM) or credit card and personal identification number (PIN)  Shopper discount card with barcode or magnetic strip  address and password  Government photo identity card (ID) and control number

© ITT Educational Services, Inc. All rights reserved.Page 14 IS3230 Access Security Multi-Factor Authentication Methods My Passion The personal image method

© ITT Educational Services, Inc. All rights reserved.Page 15 IS3230 Access Security Multi-Factor Authentication Methods (Continued) The keyboard and mouse password method

© ITT Educational Services, Inc. All rights reserved.Page 16 IS3230 Access Security Multi-Factor Authentication Methods (Continued)  Account Name–Password–Security Token  Account Name–Bank Card–PIN  Credit Card Number–PIN–Validation Number  Fingerprint–Card–Keypad  Retina Scan–Key Pad or ID

© ITT Educational Services, Inc. All rights reserved.Page 17 IS3230 Access Security EXPLORE: PROCESSES

© ITT Educational Services, Inc. All rights reserved.Page 18 IS3230 Access Security Enhanced Login Security  What is enhanced login security?  Why do I need to use enhanced login security?  How does enhanced login security work?  How do you recognize my computer?  What will adding extra security protection do for me?

© ITT Educational Services, Inc. All rights reserved.Page 19 IS3230 Access Security Enhanced Login Security (Continued)  What will happen if I remove extra security protection from this computer?  How does enhanced login security protect me?  When I add extra security, can I still log in to my account from anywhere?  Can I log in from multiple computers and browsers?

© ITT Educational Services, Inc. All rights reserved.Page 20 IS3230 Access Security EXPLORE: CONTEXTS

© ITT Educational Services, Inc. All rights reserved.Page 21 IS3230 Access Security Authentication Best Practices

© ITT Educational Services, Inc. All rights reserved.Page 22 IS3230 Access Security EXPLORE: RATIONALE

© ITT Educational Services, Inc. All rights reserved.Page 23 IS3230 Access Security Benefits of Multi-Factor Authentication  Provides a secure device or method to access network with sophisticated verification mechanisms beyond the user’s or attacker’s control  Have internal self-control mechanisms that work with a distant server or client to validate authenticity of the authentication request

© ITT Educational Services, Inc. All rights reserved.Page 24 IS3230 Access Security  Usually provide some form of encryption, compression or scrambling to protect data content  Increases the confidentiality and integrity level of network connection and throughput Benefits of Multi-Factor Authentication (Continued)

© ITT Educational Services, Inc. All rights reserved.Page 25 IS3230 Access Security Authentication Services Authentication-Process of verifying credentials Authentication services provided on a network Common types of authentication and AAA servers: Kerberos, RADIUS, LDAP Security+ Guide to Network Security Fundamentals, Fourth Edition 25

© ITT Educational Services, Inc. All rights reserved.Page 26 IS3230 Access Security Kerberos Security protocol that provides authentication and authorization services on the network Use strong cryptography. Works like using a driver’s license to cash a check Kerberos ticket Contains information linking it to the user User presents ticket to network for a service Difficult to copy Expires after a few hours or a day Security+ Guide to Network Security Fundamentals, Fourth Edition 26

© ITT Educational Services, Inc. All rights reserved.Page 27 IS3230 Access Security Single Sign-on (SSO) Access control that allowed user to log on to a system and gain access to other resources within a log on via the initial log on. Discussion.

© ITT Educational Services, Inc. All rights reserved.Page 28 IS3230 Access Security Summary  User types and potential access considerations  Multi-factor authentication  Enhanced login security  Authentication best practices

© ITT Educational Services, Inc. All rights reserved.Page 29 IS3230 Access Security Unit 6 Lab Activities Lab # 6: Enhance Security Controls Leveraging Group Policy Objects Complete the lab activities in class

© ITT Educational Services, Inc. All rights reserved.Page 30 IS3230 Access Security Unit 6 Assignments Unit 7 Assignment: Complete chapter 10 Assessment A copy of the assignment will be given in class. Reading assignment: Read Chapters 11 and 12