Software Security - Week 09

Vocabulary flashcards for SWE210 Software Security Week 9 lecture notes.

Authentication

The process of identifying and maintaining a digital identity on a computer system.

NIST SP 800-63-2

NIST Special Publication 800-63-2 provides guidelines for e-authentication architectural model.

Password-based Authentication

A common defense against intruders involving comparing a user-supplied password against a stored value.

Hashed Passwords

A security technique using hashed passwords and a salt value to enhance password protection.

Salt Value

A random value added to a password before hashing to prevent dictionary attacks and visibility of duplicate passwords.

Token-based Authentication

Authentication using physical objects a user possesses.

Memory Cards

Cards storing data but lacking processing capabilities

Smart Cards

Physical cards with embedded integrated chips for use as security tokens.

Electronic Identity Cards

Smart cards used as national identification for citizens to access government and commercial services.

Biometric Authentication

Authentication based on unique physical characteristics like fingerprints or facial features.

Remote User Authentication

Verifying a user's identity when accessing a system from outside the physical premises.

Kerberos

An authentication service developed at MIT, used to authenticate service requests between trusted hosts across untrusted networks.

Key Distribution Center (KDC)

The centralized authentication server in Kerberos, authenticating users to servers and servers to users.

Access Control

The prevention of unauthorized use of a resource.

Authentication (Access Control Principle)

The verification of an identity claimed by or for a system entity.

Authorization

The granting of a right or permission to a system entity to access a system resource.

Audit

A review and analysis of activity logs to ensure security policies are followed.

Subject (Access Control)

An entity capable of accessing objects.

Object (Access Control)

A resource to which access is controlled.

Access Right

Describes the way in which a subject may access an object.