In our next section we will talk about password policies elements and passwords.
Elton Matthews
so most systems in an enterprise network use some form of authentication to grant or deny user access
when users access a system a user name and password are usually invoked as you know at the most of the
time it is like that and it might be fairly easy to guess someone's user name based on that person's
real name.
If the user's password is set to some default value or to a word or text text string that is easy to
guess an attacker might easily gain access to the system too.
So guys think like an attacker for a moment and see if you can make some guesses about passwords you
might try if you want to log in to a random system.
Perhaps you told totes of passports like Password password 1 3 1 2 3 4 5 6 and so on right.
And perhaps you could try a username as admin and password like admin an attacker can launch an online
attack by actually entering each password.
Yes as the system prompts for user credentials.
In contrast to an offline attack occured when the attacker is able to retrieve the encrypted or hashed
passwords ahead of time then goes off line to an external computer and uses software there to repeatedly
attempt to recover the actual password.
So attackers can also use software to perform dictionary attacks to discover a user's password.
The software will automatically attempt to log in with passwords taking from a dictionary or worthless.
In this meta guys and it's might be a I'm sorry it's mine I have to go through thousands or millions
of attempts before discovering the real password.
In addition the software can perform a brute force attack by trying every possible combination of letter
number and symbols strings and brute force brute force attacks Rick are really very power powerful computing
resources and a large amount of time and to mitigate password attacks an enterprise should implement
a password policies for all users guys.
Such a policy might include guidelines that require a long password string made up of a combination
of upper and lower case characters along with numbers and some special characters.
Maybe the goal is to require all passwords to be complex strings that are difficult to guess or reveal
by a password attack as well.
Password management should require all passwords to be changed periodically so that even length the
brute force attacks would not be able to recover a password before it is changed again.
And yes.
Passports have some vulnerabilities sometimes and for critical systems enterprises mostly consider to
use passwords alternatives and they are multi factor authentication physical access control certificates
and their biometrics.
And let's take a look to these alternatives and learn about them.
As simple passwords passwords string in the single factor that a user must enter to be authenticated
because a password should be remembered and not written down to anywhere you might think of your password
as something you know hopefully nobody else knows this too.
Otherwise they could use it to impersonate when you authenticating right multi factor authentication.
Which is also known as MFA is an authentication method in which a computer user is granted access only
after successfully persisting two or more pieces or of evidence or factors to an authentication mechanism.
No Lich and something the user and only the user knows that means and possession something the user
and the only the user has and inherits something the user and the only the user s and two factor authentication
for example also known as to FAA is at type or subset of multi factor authentication.
It is a method of confirming users claimed identities by using a combination of two different factors
one something they know 2 something they have or 3 something they are a good example of two factor authentication
is the throwing of money for and 18 for example.
All of us do this right.
Then only the correct combination of a bank card and PIN number allows the transaction to be carried
out.
Two other examples are supplement a user controlled password with a one time password to a OTP or code
generated or received by an authenticator.
For example like it may be a security token or a smartphone that only the user possesses let's go ahead
with the digital certificates at digital certificate can serve as one alternative factor because it
serves as a trusted form of identification and adherence to a standardized format and contains encrypted
information guys.
If an enterprise support certificate to use then a user must request and be granted a unique certificate
to use for specific purposes for example certificates used for authenticating users must be approved
for authentication in order to be trusted.
Certificates must be granted to and digitally signed by a trusted certificate authority known as S.A..
As long as these services used by these sent enterprise gnome and the trust to see a then individual
certificate signed by that S.A. can be trusted as well.
Biometric credentials are another password alternative can be used and biometric credentials carry this
scheme even further by providing a factor that represents something you are.
The idea is to use some physical attribute from a user's body to uniquely identify that person physical
attributes are usually unique to each individual's body structure and cannot be easily stolen or duplicate
that right and for example a user's fingerprint can be scanned and used as an authentication factor.
Other examples include face recognition palm prints and voice recognition iris recognition and retinal
scans.
As you might expect some methods can be trusted more than others and sometimes facial recognition systems
can be fooled when presented with photographs or masks of trusted individuals.
Injuries and the aging process can also alter biometric patterns such as fingerprints facial shapes
and iris patterns to help mitigate potential weaknesses.
Multiple biometric credentials can be collected and used to authenticate so users as well.