Authentication, Access, Cryptography

what are the parts of CIA triad

Confidentiality, integrity, availability

what are the three main defense tools

authentication, access control, cryptography

what is authentication? what are 3 methods of authentication?

the act of proving that a user is who he/she says she is

something the user knows, something the user is, something the user has

what does ‘something you know’ mean? examples? what to avoid?

a secret only the real user should know

passwords, passphrases, pins

avoid security questions

are passwords always good?

no, passwords are still the front door and are leaked all the time. stolen credentials are the most common first step into a network and can even be reused

what is wrong with a lot of passwords?

reused or duplicated, short, not mixed case, no digits, common known passwords like (123456, admin, password, 12345, 123456788, etc.)

how do passwords get stolen? (6)

phising: fake login page or message tricks you into typing it

infostealer malware: steals saved browser passwords and session cookies

credential stuffing: replays leaked email + passwords pairs on other sites repeatedly

password spraying: tries a few common passwords on many accounts to avoid lockout

online guessing: guesses at the real login page, slowed by rate limits

offline cracking: guesses against a stolen hash file at GPU speed, no limits

how are guesses made smartly? some common rules?

dictionary and rule-based guessing, attackers guess what people actually chose, not random strings

start with a normal word or string → capitalizing, appending numbers that mean something, changing out some letters for digits or symbols, etc.

another way to make guesses? how long would it take (equation)? is length or symbols better?

brute force, all possibilities

time = possibilities / guesses per second, where possibilities = choices ^ length

length beats symbols

slow hash vs fast hash

slow hash designed to be slow so its harder to crack

best way to store passwords? example? is hash one way or two way?

store a one way hash of the password and never the password iself

eg u have customer database, john sets password as lovehonay, ur database should store SHA-256 hashed version of john’s password

hash function is one way, so u will always be able to check if pw is correct, but if someone looks in ur db, they can’t figure out the original passwords

what can you still tell from hashed password? what is the fix?

if hash is the same, password is the same, meaning those accounts share a password and its probably weak, otherwise unlikely they would have the same password

adding some salt

what is a rainbow table?

a precomputed lookup from hash back to passwords for popular passwords

what is salt? why does it work? what are some rules for salt?

random data added to each password before hashing e.g. hash(salt + pw)

same password, different hash, so no more duplicated and precomputed tables are useless

random salt should be unique per password and is not secret, stored next to the hash

modern password rules dos and donts

do: at least 15 characters if no mfa, and more i couldnt right down mm
dont: composition rules, periodic expiration not helpful, password hunts, security questions, truncating long pws

other ways of cracking passwords? takeaway?

1. collect motion data while typing, train an ml model, detect what he/she typed. web browsers and apps used to be able to read motion sensors without asking

2. keyboard sounds, keystrokes can be identified from a nearby phone or over a zoom call, deep learning model learned the sound of each key on a laptop

password alone can leak, add a second factor

what does ‘something you are’ mean? is it perfect? is it better to raise or lower the threshold?

biometrics

biometrics mever match exactly, a similarity score is compared to a threshold

raising the threshold = fewer false accepts, more false rejects which is annoying

lowering the threshold = more convenient but less secure

what are problems with biometrics?

intrusive, expensive, single point of failure (eg battery dies etc), false readings, speed, forgery

what does ‘something you have’ mean?

token

authenticator apps, hardware security keys, passkeys (recommended), sms codes (weakest)

multifactor autnethication tradeoff?

most security implementations are single factor authentication, some require two or more, no optimal number of authentication factors → balancing usability vs security

access control goals? how to track access? what is policy?

check every access: users should not retain indefinite access

enforce the least privilege: users should have access to fewest necessary

verify acceptable usage: do not give complete control of resource unless required

track by enforcing at the appropriate granularity and use audit logging to track access

policy: who + what + how = yes/no

implementing access control methods

??

what is access control directory method?

each user has a file directory, which lists all the files to which the user has access

access control matrix method? issue?

users as rows, files as columns, access in the cells

sparse since most cells are empty in practice

access control list

ACL has on directory per object, not per user like access control directory

e.g. file F has list to user a with ORW, user s with R, user x, etc.

access control matrix ccan be turned into what via slicing

taking a column will produce the access control list of a file, and row will contain the capability list of a user

role based access control

permissions given to roles, then people are given roles

linux file/folder permissions: what is a group? types of linux file permissions? types of people? 3 each

a group: a collection of users, used as a target of permissions

every file has an associated group, user can belong to multiple groups, groups are given access to a file or resource

owner can grant permissions and whatnot

types of permission: read, write, execute

types of people: owner (u), group(g), others(o)

how to view permissions in linux

ls -l

file permissions example: -rwxr-xr-x. 1 owner group etc.

owner has rwx, group has rx, others have rx

how to change permisions? letter codes example? octal base-8 code? what does -R mean?

chmod who(+-)what filename

chmod u+rw myfile.txt, allow owner to read/write

chmod NNN filename

three numbers between 0-7 for owner, group, and others

each gets +4 to allow read, +2 for write, +1 for execute

eacmple: chmod 600 myfile.txt → owner can read/write would be 700 if all 3

example: chmod 664 grades.dat → owner rw, group rw, other x

use -R for recursive, i guess that means for everything inside as well

directory permissions, is it diff from file permisions

different from file, is possible to have file permission but not directory permission, so you actually cant access it

can have read permission for directory but not execute (can ls but not cd into it) and vice versa (can cd into it but no ls)