1 1 00:00:00,540 --> 00:00:01,620 Single sign-on 2 2 00:00:01,620 --> 00:00:04,140 and multifactor authentication. 3 3 00:00:04,140 --> 00:00:07,830 In this lesson, we're going to talk about SSO and MFA. 4 4 00:00:07,830 --> 00:00:09,810 First, let's start with SSO. 5 5 00:00:09,810 --> 00:00:11,340 This is single sign-on. 6 6 00:00:11,340 --> 00:00:13,770 Single sign-on is an authentication technology 7 7 00:00:13,770 --> 00:00:16,050 that enables a user to authenticate once 8 8 00:00:16,050 --> 00:00:18,960 and then receive authorizations for multiple services. 9 9 00:00:18,960 --> 00:00:21,240 Now, there's both advantages and disadvantages 10 10 00:00:21,240 --> 00:00:23,310 to using something like single sign-on. 11 11 00:00:23,310 --> 00:00:24,750 When you use single sign-on, 12 12 00:00:24,750 --> 00:00:25,980 the user doesn't have to 13 13 00:00:25,980 --> 00:00:27,960 have multiple usernames and passwords. 14 14 00:00:27,960 --> 00:00:29,220 This is a good thing, 15 15 00:00:29,220 --> 00:00:30,840 one password to rule them all. 16 16 00:00:30,840 --> 00:00:32,880 It's one nice hard, challenging password 17 17 00:00:32,880 --> 00:00:33,713 that you can memorize 18 18 00:00:33,713 --> 00:00:35,580 and then use to get onto everything 19 19 00:00:35,580 --> 00:00:36,630 because you log on once 20 20 00:00:36,630 --> 00:00:38,490 and have access to all the systems. 21 21 00:00:38,490 --> 00:00:39,750 That's a great advantage 22 22 00:00:39,750 --> 00:00:41,310 but the disadvantage is 23 23 00:00:41,310 --> 00:00:42,750 you only have one password. 24 24 00:00:42,750 --> 00:00:44,940 So if your user account is compromised, 25 25 00:00:44,940 --> 00:00:48,330 that attacker now has access to everything. 26 26 00:00:48,330 --> 00:00:49,890 For example, I talked about before, 27 27 00:00:49,890 --> 00:00:51,420 you can use something like LastPass, 28 28 00:00:51,420 --> 00:00:53,010 which is a password manager. 29 29 00:00:53,010 --> 00:00:54,540 Now this isn't necessarily single sign-on 30 30 00:00:54,540 --> 00:00:55,800 but it's the same concept. 31 31 00:00:55,800 --> 00:00:57,750 If your master password is compromised, 32 32 00:00:57,750 --> 00:00:59,700 they now have access to all of your sites. 33 33 00:00:59,700 --> 00:01:00,570 Well, with single sign-on, 34 34 00:01:00,570 --> 00:01:01,740 it's essentially the same thing 35 35 00:01:01,740 --> 00:01:03,000 because you log in once 36 36 00:01:03,000 --> 00:01:04,920 and get access to all of the sites, 37 37 00:01:04,920 --> 00:01:06,840 and so if that one password gets compromised, 38 38 00:01:06,840 --> 00:01:08,310 they get everything. 39 39 00:01:08,310 --> 00:01:10,770 So this is a bad thing about single sign-on. 40 40 00:01:10,770 --> 00:01:12,270 Now, when you're using single sign-on, 41 41 00:01:12,270 --> 00:01:13,410 for instance on a Windows domain, 42 42 00:01:13,410 --> 00:01:15,030 you log onto your Windows domain, 43 43 00:01:15,030 --> 00:01:16,410 you have access to all the files 44 44 00:01:16,410 --> 00:01:17,640 and email and everything else, 45 45 00:01:17,640 --> 00:01:18,690 that is single sign-on. 46 46 00:01:18,690 --> 00:01:21,180 That's using Kerberos as a single sign-on tool. 47 47 00:01:21,180 --> 00:01:23,490 Now the next one we're going to talk about is MFA 48 48 00:01:23,490 --> 00:01:25,740 which is multifactor authentication. 49 49 00:01:25,740 --> 00:01:27,300 This is the buzzword these days. 50 50 00:01:27,300 --> 00:01:29,400 Everybody needs to have MFA. 51 51 00:01:29,400 --> 00:01:31,080 This is an authentication scheme 52 52 00:01:31,080 --> 00:01:32,370 that requires the user to present 53 53 00:01:32,370 --> 00:01:34,950 at least two different factors of credentials. 54 54 00:01:34,950 --> 00:01:36,570 This can come from something you know, 55 55 00:01:36,570 --> 00:01:38,160 such as a username and password, 56 56 00:01:38,160 --> 00:01:41,160 something you have like a token or a fob, 57 57 00:01:41,160 --> 00:01:42,960 something you are like a fingerprint 58 58 00:01:42,960 --> 00:01:44,250 or an eyeball scan, 59 59 00:01:44,250 --> 00:01:45,600 something you do such as 60 60 00:01:45,600 --> 00:01:46,680 the way you sign your name, 61 61 00:01:46,680 --> 00:01:48,030 or somewhere you are 62 62 00:01:48,030 --> 00:01:48,990 such as your location 63 63 00:01:48,990 --> 00:01:50,670 and your GPS coordinates. 64 64 00:01:50,670 --> 00:01:53,370 If you have at least two of these five categories, 65 65 00:01:53,370 --> 00:01:55,680 you have multifactor authentication. 66 66 00:01:55,680 --> 00:01:58,170 Now, another buzzword you'll hear is 2FA 67 67 00:01:58,170 --> 00:02:00,240 and that's for two factor authentication. 68 68 00:02:00,240 --> 00:02:02,220 This is when only two of those factors are used, 69 69 00:02:02,220 --> 00:02:03,420 and that's the most common form 70 70 00:02:03,420 --> 00:02:05,130 of multifactor authentication. 71 71 00:02:05,130 --> 00:02:07,050 'Cause most systems aren't going to require you to have 72 72 00:02:07,050 --> 00:02:09,720 three or four or five factors, just two. 73 73 00:02:09,720 --> 00:02:12,450 Now, what makes multifactor authentication better 74 74 00:02:12,450 --> 00:02:14,250 than just using a username and password? 75 75 00:02:14,250 --> 00:02:15,330 Well, it's because you have 76 76 00:02:15,330 --> 00:02:16,950 two factors of authentication 77 77 00:02:16,950 --> 00:02:18,720 and you can even secure this even further 78 78 00:02:18,720 --> 00:02:20,910 by using things like two-step verification, 79 79 00:02:20,910 --> 00:02:23,490 biometrics, certificate-based authentication, 80 80 00:02:23,490 --> 00:02:25,500 or location-based authentication. 81 81 00:02:25,500 --> 00:02:27,390 Let's talk a little bit about each of these. 82 82 00:02:27,390 --> 00:02:29,220 Two-step authentication is when you go 83 83 00:02:29,220 --> 00:02:30,750 to log into a website 84 84 00:02:30,750 --> 00:02:33,210 and then once you put in your username and password, 85 85 00:02:33,210 --> 00:02:35,220 it sends a text message to your phone 86 86 00:02:35,220 --> 00:02:36,450 or an email to you, 87 87 00:02:36,450 --> 00:02:37,650 and then you have to get that code 88 88 00:02:37,650 --> 00:02:39,210 and enter it into the website. 89 89 00:02:39,210 --> 00:02:41,070 This now gives you two factors, 90 90 00:02:41,070 --> 00:02:43,290 something you know, your username and password, 91 91 00:02:43,290 --> 00:02:44,550 and something you have, 92 92 00:02:44,550 --> 00:02:46,740 your cell phone receiving that text message. 93 93 00:02:46,740 --> 00:02:49,350 That's the idea of a two-step verification. 94 94 00:02:49,350 --> 00:02:51,240 Now, this is a really good way of doing things 95 95 00:02:51,240 --> 00:02:52,260 and one of the reasons 96 96 00:02:52,260 --> 00:02:53,520 it's very widely implemented 97 97 00:02:53,520 --> 00:02:56,370 is because almost everybody now has a cell phone, 98 98 00:02:56,370 --> 00:02:58,230 and so you don't have to have special hardware, 99 99 00:02:58,230 --> 00:03:00,000 you just have to have any smartphone 100 100 00:03:00,000 --> 00:03:02,160 and you can then get this two-factor authentication. 101 101 00:03:02,160 --> 00:03:04,740 Now, another way you can use multifactor authentication 102 102 00:03:04,740 --> 00:03:06,240 is by using biometrics, 103 103 00:03:06,240 --> 00:03:08,670 and most of our smartphones use biometrics now. 104 104 00:03:08,670 --> 00:03:09,810 You have a fingerprint scanner 105 105 00:03:09,810 --> 00:03:12,000 or a face ID like on my iPhone, 106 106 00:03:12,000 --> 00:03:13,830 and this is the idea of using biometrics 107 107 00:03:13,830 --> 00:03:15,420 as a login mechanism. 108 108 00:03:15,420 --> 00:03:18,810 Now is face ID multifactor authentication? 109 109 00:03:18,810 --> 00:03:21,000 No, because when you pull up that phone 110 110 00:03:21,000 --> 00:03:22,110 and you use your face, 111 111 00:03:22,110 --> 00:03:23,790 you're only using your face. 112 112 00:03:23,790 --> 00:03:26,040 Yes, it's more secure than using a password 113 113 00:03:26,040 --> 00:03:27,690 but it's not requiring two factors. 114 114 00:03:27,690 --> 00:03:29,460 It's only requiring your face. 115 115 00:03:29,460 --> 00:03:32,040 So this would not be multifactor by itself, 116 116 00:03:32,040 --> 00:03:34,380 but if I had to put in a pin and my face, 117 117 00:03:34,380 --> 00:03:36,120 or a password and my face, 118 118 00:03:36,120 --> 00:03:38,310 that would then be multifactor authentication. 119 119 00:03:38,310 --> 00:03:40,890 Another factor you can use is certificate-based 120 120 00:03:40,890 --> 00:03:43,350 and this is often done using digital certificates. 121 121 00:03:43,350 --> 00:03:45,060 For instance, on my iPhone 122 122 00:03:45,060 --> 00:03:46,740 I have some digital certificates installed 123 123 00:03:46,740 --> 00:03:49,830 that identify me as the person holding that phone. 124 124 00:03:49,830 --> 00:03:51,300 So when I go to certain websites, 125 125 00:03:51,300 --> 00:03:54,510 it uses that digital certificate to log me in. 126 126 00:03:54,510 --> 00:03:56,220 Between that and my username and password, 127 127 00:03:56,220 --> 00:03:58,440 I now have multifactor authentication. 128 128 00:03:58,440 --> 00:04:01,080 In my case, it's a digital certificate and a pin number, 129 129 00:04:01,080 --> 00:04:01,913 and that would let me get 130 130 00:04:01,913 --> 00:04:03,930 into the website I need to get into. 131 131 00:04:03,930 --> 00:04:06,120 And the final one is location-based. 132 132 00:04:06,120 --> 00:04:08,550 This can be done based on your IP address location, 133 133 00:04:08,550 --> 00:04:10,710 although that's easily spoofed through VPNs, 134 134 00:04:10,710 --> 00:04:12,170 or your actual GPS coordinates 135 135 00:04:12,170 --> 00:04:14,610 which is a much better way of doing it. 136 136 00:04:14,610 --> 00:04:16,500 This again, is another factor you can use 137 137 00:04:16,500 --> 00:04:18,030 as part of your multifactor, 138 138 00:04:18,030 --> 00:04:19,950 but if you're just using login by itself 139 139 00:04:19,950 --> 00:04:21,600 based on your GPS location, 140 140 00:04:21,600 --> 00:04:23,010 that is a single factor. 141 141 00:04:23,010 --> 00:04:24,900 So for example, if I wanted to log 142 142 00:04:24,900 --> 00:04:26,640 into my corporate file share, 143 143 00:04:26,640 --> 00:04:28,200 I can pull up my iPhone, 144 144 00:04:28,200 --> 00:04:30,900 it can detect where I am in the world based on my GPS, 145 145 00:04:30,900 --> 00:04:32,270 and if I am within the United States 146 146 00:04:32,270 --> 00:04:34,080 and I have the right username and password, 147 147 00:04:34,080 --> 00:04:35,370 it would let me log in. 148 148 00:04:35,370 --> 00:04:37,890 That could be a form of multifactor authentication 149 149 00:04:37,890 --> 00:04:39,510 because in my authentication scheme, 150 150 00:04:39,510 --> 00:04:40,860 you must be in the United States 151 151 00:04:40,860 --> 00:04:42,750 and you must have the username and password. 152 152 00:04:42,750 --> 00:04:45,450 That's a pretty generic range of locations 153 153 00:04:45,450 --> 00:04:46,920 but you could make it even more specific 154 154 00:04:46,920 --> 00:04:48,330 and say you must be in this city 155 155 00:04:48,330 --> 00:04:49,770 or within this 50 feet, 156 156 00:04:49,770 --> 00:04:51,330 you must be within our office building, 157 157 00:04:51,330 --> 00:04:52,590 or something like that. 158 158 00:04:52,590 --> 00:04:54,270 But again, location-based can be done 159 159 00:04:54,270 --> 00:04:56,070 as a way to identify fraud 160 160 00:04:56,070 --> 00:04:57,300 and figure out if your employees 161 161 00:04:57,300 --> 00:04:58,740 really are where they say they are. 162 162 00:04:58,740 --> 00:04:59,820 If I have an employee who's trying 163 163 00:04:59,820 --> 00:05:01,770 to log in from Russia or China 164 164 00:05:01,770 --> 00:05:03,180 and they're sitting in the office, 165 165 00:05:03,180 --> 00:05:04,500 well that's obviously fraud, 166 166 00:05:04,500 --> 00:05:05,670 and we can then go ahead 167 167 00:05:05,670 --> 00:05:06,900 and turn that account off 168 168 00:05:06,900 --> 00:05:08,760 and figure out how that account has been compromised 169 169 00:05:08,760 --> 00:05:09,720 and get it fixed. 170 170 00:05:09,720 --> 00:05:10,553 So this again, is one 171 171 00:05:10,553 --> 00:05:12,240 of those additional factors you can use. 172 172 00:05:12,240 --> 00:05:14,280 Usually it won't be your primary factor 173 173 00:05:14,280 --> 00:05:15,900 but it could be a factor that you use 174 174 00:05:15,900 --> 00:05:17,340 as a third degree to make sure 175 175 00:05:17,340 --> 00:05:18,960 the person has their username and password, 176 176 00:05:18,960 --> 00:05:20,640 and has their security token, 177 177 00:05:20,640 --> 00:05:21,930 and they're actually in the state 178 178 00:05:21,930 --> 00:05:23,160 you think they should be in 179 179 00:05:23,160 --> 00:05:24,810 when they're logging into that service. 180 180 00:05:24,810 --> 00:05:26,490 And that's why it's a good third 181 181 00:05:26,490 --> 00:05:28,380 or fourth factor that you might want to use. 182 182 00:05:28,380 --> 00:05:30,060 But in general, you're going to use 183 183 00:05:30,060 --> 00:05:33,000 mostly two-factor authentication or a biometrics 184 184 00:05:33,000 --> 00:05:34,740 in addition with the username and password 185 185 00:05:34,740 --> 00:05:37,390 to be able to create good multifactor authentication.