Cyber security authentication

the confirmation of the identity of someone attempting to access a resource.

Type I

What You Know

Type II

What You Have

Type III

What You Are

Username - may be an email address or username chosen by the user

Password - strings of text

Passphrase - a string of text that is longer than a typical password

Mother’s maiden name

Pet’s name

Access a device

Unlock a door

• A personal identification number (PIN), is a number, normally 4 - 6 digits in length, that a user sets to use as identification.

• PIN numbers are most commonly used with debit cards.

Digital access badges and/or cards are coded with unique digital information associated with the owner. The information is read either using RFID or a chip reader into which the card is inserted.

Fob/Dongle

Fob is issued to you by the organization with which you have an account.

YubiKeyYubi Key

a physical device that has an embedded chip that you register as a unique identifier.

• A software token is similar to a fob-style hardware token in that it generates a unique code that is only good for 30 seconds.

• One-time codes and one-time passwords can only be used once, normally within a short period of time after receiving it.

is when only one “type: of authentication is used.

Two-factor authentication (2FA) is the use of two different “types” of authentication.

The use of at least two different “types” of authentication.

a session and user authentication service that permits a user to use one set of login credentials to access multiple applications.

Password length is the single biggest factor in how long it takes to brute force crack the password.

Recycling of passwords (using the same password for multiple accounts) is problematic because, should the password get compromised, your password is compromised for all the accounts for which you use it.

A passphrase is a string of text that is longer than a typical password.

Recycling of passwords (using the same password for multiple accounts) is problematic because, should the password get compromised, your password is compromised for all the accounts for which you use it.

• Users should choose a password that is between 8 - 24 ASCII or Unicode characters, including spaces.

• The bare minimum is 8 characters; NIST recommends 15 characters.

It make the password harder to hack or guess by hacker

forcing users to frequently change their passwords often leads to them choosing weaker passwords

• Authorization is confirming the user has permission to access the resource.

• It also includes confirming the requested level of access for that resource.

Individual users should have only the privileges needed to perform their job responsibilities.

Mandatory Access Control (MAC)

• the most strictly enforced control method.

• All access control settings are only accessible by the administrator.

Rule-Based Access Control (RuBAC)

• allows the administrator to set rules on objects that an individual user must meet in order to access an object, regardless of the user’s role and/or access/permissions.

Role-Based Access Control (RBAC)

• allows the administrator to group individuals together and assign permissions for specific roles.

Discretionary Access Control (DAC)

• allows the object owner to grant another user or group additional rights to an object beyond what is allowed by assigned access level.

Attribute-Based Access Control (ABAC)

• evaluates attributes instead of roles or users.

Explicit Permissions

• The user is specifically given the assigned permissions granted for that directory or file.

Inherited Permissions

• The user receives the permissions by default at a lower level due to permissions that were set at a higher level.

Implicit Permissions

• The user receives the permissions through another object, such as a group.

The system will check the ACL whenever a user tries to access that resource to verify the user has explicit, implicit, or inherited permission to access the resource as well as what type of access (read, write, execute).

protect accountants and accountant firms from some of the risks of cyberattacks and data breaches.

• The logs can be used to troubleshoot problems on a device.

• They can also reveal clues of potential security issues

Security logs contain security-related events.

• Network administrators must set the audit policies based on their risk management plan.

Event Viewer

• Non-repudiation is the ability to verify that someone did something so they can’t later deny they did that action.

1

Biometrics

2

Video Cameras

3

Signatures

4

Digital Signatures

5

Receipts

Individual files can be encrypted on a Windows machine.

Whole-disk encryption renders all data on the entire disk unreadable without the encryption key to unlock it.

Bitlocker

FileVault

Signature-Based Detection – checks all the executable programs and files & validates them with a known list of viruses & other types of malware

Heuristic Detection – scan for previously unknown viruses by looking for known suspicious behavior or file structures 

Malware definitions contain signatures for new viruses and malware considered “wild” .

stop viruses, worms, etc., at the perimeter of the network before they can even get to the individual machines on the network.

Block/allow/filter specific ports (HTTP, HTTPS, SSH, etc.)

Block/allow specific IP addresses or address ranges

Block/allow packets for certain applications

Pre-installed application on an operating system

Separate third-party application installed on an operating system

Dedicated hardware device with special firewall software installed on it

Configure your proxy server to also act as a firewall

Block/allow/filter specific ports (HTTP, HTTPS, SSH, etc.)

Block/allow specific IP addresses or address ranges

Block/allow packets for certain applications

Pre-installed application on an operating system

Separate third-party application installed on an operating system

Dedicated hardware device with special firewall software installed on it

Configure your proxy server to also act as a firewall

Window Defender Firewall

Uninstall Window Defender

provides increased security by creating multiple layers of defense, significantly reducing the risk of a successful cyberattack by forcing potential threats to bypass multiple security checks before reaching critical internal systems

Host-based firewalls help protect against threats that come from within the corporate network (both the internal and perimeter networks) as well as from outside of the corporate network.

• a program or device that creates a barrier between the local area network and the Internet.

DMZ

• An intrusion detection system (IDS) detects potential threats and alerts a system administrator.

• An intrusion prevention system (IPS) not only detects and alerts, it takes actions to stop an attack.

IDS will be connected to one of its LAN ports

Fault Tolerance

refers to the ability of a system (computer, network, cloud cluster, etc.

Redundancy

provides fault tolerance through duplication that helps keep a system available even after a component failure.

Hardware Redundancy

occurs when there are multiple hardware devices operating that can assume a specific role. 

Data Redundancy

occurs when the same piece of data exists in multiple places.

Site Redundancy

occurs when there is a duplicate site of another location’s computers and data.

Mirrored Hardware

provides fault tolerance by having an identical server running in parallel.

Network Redundancy

provides a network server with more than one connection to the network.

Redundant Array of Independent Disks (RAID) is an advanced virtual data storage technology that consists of two or more hard drives in a single unit.

Digital Linear Tape (DLT) is still a popular and cost-effective way to backup large quantities of data. 

Kept the backup storage media in the locked fireproof safe.

The preferred location for data backup is at an offsite location.

The cloud based backup site on a network while the physical offsite backup site is on a permanent hardware.

What devices need to be backed up

Server, user devices

What data needs to be backed up

user files, entire databases, device images

When data needs to be backed up

Nightly, weekly, monthly

1. Most recent full backup

Restores all data prior to the date/time of the full backup.

2. Most recent differential backup

Restores all data from the date/time of the full backup to the date/time of the differential backup.

3. Incremental backups done after the differential backup (in sequence from oldest to newest)

Restores all data from the date/time of the differential backup.

1. Incremental backups Restores all data from the date/time of the differential backup.

An Uninterrupted Power Supply (UPS) is normally put on critical equipment to continue to provide power and give the operators time to properly power down the equipment for extended power outages. 

A backup generator can be installed to immediately start should the facility suffer a power outage.

The UPS will keep the equipment operational in the brief period of time between power loss and backup power.