Presenter: Single sign-on 2 2
and multifactor authentication. 3 3
In this lesson, we're going to talk about SSO and MFA. 4 4
First, let's start with SSO. 5 5
This is single sign-on. 6 6
Single sign-on is an authentication technology 7 7
that enables a user to authenticate once 8 8
and then receive authorizations for multiple services. 9 9
Now, there's both advantages and disadvantages 10 10
to using something like single sign-on. 11 11
When you use single sign-on, 12 12
the user doesn't have to 13 13
have multiple usernames and passwords. 14 14
This is a good thing, 15 15
one password to rule them all. 16 16
It's one nice hard, challenging password 17 17
that you can memorize 18 18
and then use to get onto everything 19 19
because you log on once 20 20
and have access to all the systems. 21 21
That's a great advantage 22 22
but the disadvantage is 23 23
you only have one password. 24 24
So if your user account is compromised, 25 25
that attacker now has access to everything. 26 26
For example, I talked about before, 27 27
you can use something like LastPass, 28 28
which is a password manager. 29 29
Now this isn't necessarily single sign-on 30 30
but it's the same concept. 31 31
If your master password is compromised, 32 32
they now have access to all of your sites. 33 33
Well, with single sign-on, 34 34
it's essentially the same thing 35 35
because you log in once 36 36
and get access to all of the sites, 37 37
and so if that one password gets compromised, 38 38
they get everything. 39 39
So this is a bad thing about single sign-on. 40 40
Now, when you're using single sign-on, 41 41
for instance on a Windows domain, 42 42
you log onto your Windows domain, 43 43
you have access to all the files 44 44
and email and everything else, 45 45
that is single sign-on. 46 46
That's using Kerberos as a single sign-on tool. 47 47
Now the next one we're going to talk about is MFA 48 48
which is multifactor authentication. 49 49
This is the buzzword these days. 50 50
Everybody needs to have MFA. 51 51
This is an authentication scheme 52 52
that requires the user to present 53 53
at least two different factors of credentials. 54 54
This can come from something you know, 55 55
such as a username and password, 56 56
something you have like a token or a fob, 57 57
something you are like a fingerprint 58 58
or an eyeball scan, 59 59
something you do such as 60 60
the way you sign your name, 61 61
or somewhere you are 62 62
such as your location 63 63
and your GPS coordinates. 64 64
If you have at least two of these five categories, 65 65
you have multifactor authentication. 66 66
Now, another buzzword you'll hear is 2FA 67 67
and that's for two factor authentication. 68 68
This is when only two of those factors are used, 69 69
and that's the most common form 70 70
of multifactor authentication. 71 71
'Cause most systems aren't going to require you to have 72 72
three or four or five factors, just two. 73 73
Now, what makes multifactor authentication better 74 74
than just using a username and password? 75 75
Well, it's because you have 76 76
two factors of authentication 77 77
and you can even secure this even further 78 78
by using things like two-step verification, 79 79
biometrics, certificate-based authentication, 80 80
or location-based authentication. 81 81
Let's talk a little bit about each of these. 82 82
Two-step authentication is when you go 83 83
to log into a website 84 84
and then once you put in your username and password, 85 85
it sends a text message to your phone 86 86
or an email to you, 87 87
and then you have to get that code 88 88
and enter it into the website. 89 89
This now gives you two factors, 90 90
something you know, your username and password, 91 91
and something you have, 92 92
your cell phone receiving that text message. 93 93
That's the idea of a two-step verification. 94 94
Now, this is a really good way of doing things 95 95
and one of the reasons 96 96
it's very widely implemented 97 97
is because almost everybody now has a cell phone, 98 98
and so you don't have to have special hardware, 99 99
you just have to have any smartphone 100 100
and you can then get this two-factor authentication. 101 101
Now, another way you can use multifactor authentication 102 102
is by using biometrics, 103 103
and most of our smartphones use biometrics now. 104 104
You have a fingerprint scanner 105 105
or a face ID like on my iPhone, 106 106
and this is the idea of using biometrics 107 107
as a login mechanism. 108 108
Now is face ID multifactor authentication? 109 109
No, because when you pull up that phone 110 110
and you use your face, 111 111
you're only using your face. 112 112
Yes, it's more secure than using a password 113 113
but it's not requiring two factors. 114 114
It's only requiring your face. 115 115
So this would not be multifactor by itself, 116 116
but if I had to put in a pin and my face, 117 117
or a password and my face, 118 118
that would then be multifactor authentication. 119 119
Another factor you can use is certificate-based 120 120
and this is often done using digital certificates. 121 121
For instance, on my iPhone 122 122
I have some digital certificates installed 123 123
that identify me as the person holding that phone. 124 124
So when I go to certain websites, 125 125
it uses that digital certificate to log me in. 126 126
Between that and my username and password, 127 127
I now have multifactor authentication. 128 128
In my case, it's a digital certificate and a pin number, 129 129
and that would let me get 130 130
into the website I need to get into. 131 131
And the final one is location-based. 132 132
This can be done based on your IP address location, 133 133
although that's easily spoofed through VPNs, 134 134
or your actual GPS coordinates 135 135
which is a much better way of doing it. 136 136
This again, is another factor you can use 137 137
as part of your multifactor, 138 138
but if you're just using login by itself 139 139
based on your GPS location, 140 140
that is a single factor. 141 141
So for example, if I wanted to log 142 142
into my corporate file share, 143 143
I can pull up my iPhone, 144 144
it can detect where I am in the world based on my GPS, 145 145
and if I am within the United States 146 146
and I have the right username and password, 147 147
it would let me log in. 148 148
That could be a form of multifactor authentication 149 149
because in my authentication scheme, 150 150
you must be in the United States 151 151
and you must have the username and password. 152 152
That's a pretty generic range of locations 153 153
but you could make it even more specific 154 154
and say you must be in this city 155 155
or within this 50 feet, 156 156
you must be within our office building, 157 157
or something like that. 158 158
But again, location-based can be done 159 159
as a way to identify fraud 160 160
and figure out if your employees 161 161
really are where they say they are. 162 162
If I have an employee who's trying 163 163
to log in from Russia or China 164 164
and they're sitting in the office, 165 165
well that's obviously fraud, 166 166
and we can then go ahead 167 167
and turn that account off 168 168
and figure out how that account has been compromised 169 169
and get it fixed. 170 170
So this again, is one 171 171
of those additional factors you can use. 172 172
Usually it won't be your primary factor 173 173
but it could be a factor that you use 174 174
as a third degree to make sure 175 175
the person has their username and password, 176 176
and has their security token, 177 177
and they're actually in the state 178 178
you think they should be in 179 179
when they're logging into that service. 180 180
And that's why it's a good third 181 181
or fourth factor that you might want to use. 182 182
But in general, you're going to use 183 183
mostly two-factor authentication or a biometrics 184 184
in addition with the username and password 185 185
to be able to create good multifactor authentication.