Lesson 7 Implementing Authentication Controls

Vocabulary-style flashcards covering IAM concepts, authentication methods, protocols, biometrics, and related technologies from Lesson 7.

Identity and Access Management (IAM)

A set of processes and technical controls that identify subjects (users, devices, processes) and govern how they may interact with resources, typically described by four main processes: identification, authentication, authorization, and accounting.

Identification

Creating an account or ID that uniquely represents the user, device, or process on the network.

Authentication

Proving that a subject is who or what it claims to be by presenting credentials that are checked against stored credentials.

Authorization

Determining what rights a subject should have on each resource and enforcing those rights.

Accounting

Tracking authorized usage of a resource and alerting when unauthorized use is detected.

AAA

Authentication, Authorization, and Accounting—the three core IAM functions.

Something You Know

A knowledge factor used for authentication, such as a password, PIN, or passphrase.

Something You Have

An ownership factor used for authentication, such as a smart card, USB token, or fob.

Something You Are/Do

A biometric or behavioral factor used for authentication (e.g., fingerprint, gait, voice).

Something You Exhibit

A behavioral-based authentication factor based on how a person uses a device or system.

Someone You Know

A web-of-trust authentication model (e.g., PGP) where trust is vouched for by others.

Location-based authentication

Using geographic location or IP/zone information as part of the authentication/authorization context.

Authentication Attributes

Contextual properties or non-unique factors that cannot be used alone for authentication but inform decisions.

Multifactor Authentication (MFA)

Authentication that combines more than one type of factor (e.g., knowledge + possession or biometrics).

Two-Factor Authentication (2FA)

MFA using two distinct factors, such as a password plus a smart card or OTP.

Three-factor authentication

Authentication that uses three distinct factors (e.g., knowledge, possession, and biometrics).

Kerberos

A network authentication protocol for SSO that uses a Key Distribution Center (KDC) with AS and TGS to issue tickets.

Key Distribution Center (KDC)

The service in Kerberos that issues authentication tokens, including AS and TGS services.

Authentication Service (AS)

Kerberos component that authenticates user logons and issues the initial Ticket Granting Ticket (TGT).

Ticket Granting Service (TGS)

Kerberos component that issues service tickets after validating the TGT.

Ticket Granting Ticket (TGT)

A time-stamped ticket proving authentication; used to obtain service tickets for resources.

Service Ticket

A ticket that grants access to a specific application server, issued by the TGS.

Single Sign-On (SSO)

Authentication system where a user authenticates once to access multiple compatible applications without re-entering credentials.

Windows Kerberos SSO

Kerberos-based SSO implemented in Windows environments, often with Active Directory domain controllers.

PAP

Password Authentication Protocol; an unsophisticated, clear-text-style protocol used in PPP; insecure without encryption.

CHAP

Challenge Handshake Authentication Protocol; uses a three-way handshake with a hashed response to a server challenge; more secure than PAP.

MS-CHAP

Microsoft's CHAP variant; uses NTLM hashes and should be secured by a tunnel due to weaknesses.

RADIUS

Remote Authentication Dial-In User Service; UDP-based protocol with a shared secret, supports PAP/CHAP/EAP and is used for network access control.

TACACS+

Cisco's protocol for network device administration; TCP-based and encrypts all data (except the header); separates authentication, authorization, and accounting.

Extensible Authentication Protocol (EAP)

A framework for deploying multiple authentication methods, often used with 802.1X and certificates.

802.1X

Port-based Network Access Control that uses EAP methods to authenticate devices before network access; components include Supplicant, NAS, and AAA server.

EAPoL

EAP over LAN; encapsulates EAP messages for transmission over LAN between supplicant and NAS.

Smart Card Authentication

Cryptographic credentials stored on a smart card (with a PIN) used to support PKI and Kerberos logon.

Key Management Device (HSM)

Hardware device that provides centralized PKI management, tamper-evident security, and cryptographic key protection.

Trusted Platform Module (TPM)

A secure cryptoprocessor in a device used to protect keys and enable features like virtual smart cards.

Public Key Infrastructure (PKI)

A framework of policies and technologies for creating, distributing, and managing digital certificates and public-private key pairs.

Smart Card Authentication (PKI/PKI-based)

Use of cryptographic keys and certificates on a smart card to authenticate users, often with PKI and PIN.

FIDO U2F / U2F WebAuthn

Open hardware-based authentication tokens that store private keys and enable passwordless or MFA with PIN/biometrics.

Open Authentication (OATH)

Industry body and framework for open OTP-based authentication, including HOTP and TOTP algorithms.

HOTP

HMAC-based One-Time Password; uses a shared secret and a counter to generate a one-time code.

TOTP

Time-based One-Time Password; uses a shared secret and synchronized time to generate short-lived codes.

Google Authenticator

Popular mobile app implementing HOTP/TOTP for token-based authentication.

One-Time Password (OTP)

A password that is valid for a single use or short time window, enhancing security.

2-Step Verification (2SV) / 2FA limitations

Code-based verification (SMS, call, push, email) used as a second factor; shorter codes reduce risk but can be intercepted.

Password Management

Solutions (password managers, vaults, USB keys) that store and manage credentials securely, often with master passwords and optional hardware tokens.

Password Vault

Software-based password manager (often cloud-enabled) that securely stores credentials; examples include built-in OS vaults.

Biometric Performance Metrics

Key metrics for biometrics: False Rejection Rate (FRR), False Acceptance Rate (FAR), Crossover Error Rate (CER), and throughput.

Enrollment

Process of capturing a biometric sample and creating a template stored in the authentication server.

Biometric Modalities

Physical (fingerprint, iris, facial) and behavioral (voice, gait, typing) patterns used for authentication.

FRR

False Rejection Rate—the rate at which legitimate users are not recognized.

FAR

False Acceptance Rate—the rate at which an impostor is accepted.

CER

Crossover Error Rate—the point where FRR and FAR meet; lower CER indicates better accuracy.

FER

Failure to Enroll Rate—the rate at which templates cannot be created during enrollment.