-: Multifactor authentication. 2 2
In this lesson, we're going to talk about the importance 3 3
of using multifactor authentication. 4 4
So, what exactly is multifactor authentication? 5 5
Well, multifactor authentication 6 6
means that you're authenticating or proving your identity 7 7
using more than one method. 8 8
For it to be multifactor, 9 9
you have to at least two methods or more. 10 10
You can have two, three, four, or five. 11 11
Now, when you talk about different methods, 12 12
we're talking about different categories. 13 13
We're talking about something you know, 14 14
something you have, something you are, 15 15
something you do or somewhere you are. 16 16
We're going to talk about each of these in this lesson. 17 17
Now, our first one is something you know 18 18
and this is the most common factor 19 19
and it's known as a knowledge factor. 20 20
This is because you have to know something. 21 21
If it's something you know, 22 22
this would be something like a username, a password, a pin, 23 23
or answers to personal questions. 24 24
All of these are considered knowledge factors. 25 25
If you know it and I can try to figure it out, 26 26
then I would know it and now I have that knowledge too, 27 27
and I can authenticate as you. 28 28
Now, one of the common questions 29 29
I see inside the Network+ exam is asking you 30 30
what would be considered two-factor authentication? 31 31
Now, one of the answer choices they'll give you 32 32
will be something like a username and a password. 33 33
Now lots of students will see this and they'll think, 34 34
"Hey, this is a username and a password. 35 35
"That must be two factors, right? 36 36
"Cause I have two things." 37 37
But that's not true. 38 38
A username and password both come from this factor, 39 39
which is known as the knowledge factor 40 40
or something we know. 41 41
Therefore, it's still considered a single factor. 42 42
Now, this is not going to give you the best security, 43 43
so instead, we want to add a second factor 44 44
to get us 2FA, two-factor authentication, 45 45
or multifactor authentication. 46 46
So, what are some weaknesses with passwords? 47 47
Well, the most common weakness 48 48
is that people don't change default credentials. 49 49
You might have a default password on a brand new system 50 50
like a wireless router or access point 51 51
and the password is password 52 52
and nobody ever bothers to change it. 53 53
I've seen this time and time again in my penetration tests. 54 54
Don't do that. 55 55
Whenever you get a new device, 56 56
you need to go in and change those default credentials 57 57
because default credentials are really easy to guess. 58 58
Also, people will use common passwords 59 59
and that becomes a big issue. 60 60
Now, when you talk about common passwords, 61 61
that means using the same password across multiple devices 62 62
or using a common phrase or word as their password, 63 63
things like love and password and secret. 64 64
Those things are just way too common. 65 65
Now, every year there's a dictionary that comes out 66 66
called "The Attacker's Dictionary" 67 67
and it shows all the commonly used passwords. 68 68
We can use those passwords in that list 69 69
as part of a dictionary attack 70 70
to be able to find your password 71 71
pretty darn quickly in most cases. 72 72
Now, another issue we have 73 73
is that people use weak or short passwords. 74 74
If you're going to use something like dog or puppy 75 75
or cupcake or dog123, 76 76
these are all short and weak passwords. 77 77
Anything that is a standard dictionary word 78 78
is completely bad and you should not use it. 79 79
Anything less than eight characters is also pretty bad. 80 80
You really want to make sure 81 81
you have a nice long, strong, secure password 82 82
and to do that, you need uppercase letters, 83 83
lowercase letters, numbers, and special characters, 84 84
all mixed together. 85 85
This will help increase the security of your password 86 86
and you want to make sure it's a long password. 87 87
Now, if you're only going to use a single factor authentication 88 88
like a username and a password, 89 89
at least make sure you're using a long, strong password. 90 90
The reason for this is that attackers know 91 91
that they can break our passwords over time. 92 92
There's lots of different attacks we can use, 93 93
like a dictionary attack, a brute force attack 94 94
or a hybrid attack. 95 95
Now, a dictionary attack occurs 96 96
when the attacker tries to guess the password 97 97
by checking every single word or phrase 98 98
contained within a word list, which we call a dictionary. 99 99
Now, an attacker's dictionary 100 100
isn't like the dictionary you used in high school. 101 101
It doesn't contain just real words. 102 102
Many attacker's dictionaries 103 103
contain things like the word password 104 104
but they'll also sub it out 105 105
and have the a becoming an @ symbol 106 106
or the s becoming a $. 107 107
And they'll have lots of different combinations of these 108 108
in the single dictionary. 109 109
When the attacker tries to crack your password using a list, 110 110
we consider it a dictionary attack 111 111
whenever there's a list involved, 112 112
even if they're not real words. 113 113
So, the best defense against a dictionary attack 114 114
is to not use anything that looks like a regular word, 115 115
even if you start substituting in symbols for letters 116 116
that still looks like a regular word 117 117
and it's probably in an attacker's dictionary. 118 118
On the other hand, if a dictionary attack isn't successful, 119 119
the attacker may move on and try to do a brute force attack. 120 120
Now with a brute force attack, 121 121
they're going to try every possible combination 122 122
until they figure out your password. 123 123
For example, let's say your password was a pin 124 124
and it's four digits long. 125 125
Well, the attacker could start out with 0000, 126 126
then try 0001, then 0002, and they keep going up 127 127
until they finally get your four digit code, 128 128
which may be something like 5246 or whatever it was. 129 129
The thing is that with a brute force attack, 130 130
they will always be successful eventually. 131 131
It's just a matter of time. 132 132
And so the key here is to prevent them 133 133
by creating longer and more complicated passwords 134 134
because the longer and more complicated the password is, 135 135
the longer it's going to take an attacker to guess it 136 136
using brute force 137 137
and going through all the possible combinations. 138 138
For example, if you have an eight character password, 139 139
even if it has uppercase, lowercase, 140 140
numbers, and symbols in it, 141 141
it will take less than a few days to crack that password 142 142
using a decent graphics card. 143 143
Now, if I raise it up to nine characters, 144 144
it will take me about five days to crack it. 145 145
With 10 characters, it becomes four months; 146 146
11 characters, 10 years; 147 147
and 12 characters, about 200 years. 148 148
You can see there's this exponential curve here 149 149
but remember, computers are always getting faster and better 150 150
at cracking every single day. 151 151
So all these numbers I just gave you, 152 152
by next year you can cut them in half 153 153
and the year after that, cut it in half again, 154 154
and it'll keep going down and down and down, 155 155
so we have to get longer and stronger passwords. 156 156
As a good rule of thumb, you want your password to be 157 157
at least 12 characters minimum for good security. 158 158
Now, the final method a hacker can use 159 159
is what's known as a hybrid technique. 160 160
This is a mixture of a dictionary and a brute force method. 161 161
Now basically, the attacker tries to gather keywords 162 162
that would relate to your life 163 163
and then make their own custom dictionary lists. 164 164
For example, I might go on Facebook 165 165
and try to find out your spouse's name, or your dog's name, 166 166
or your favorite sports team, 167 167
and then I put all the words related to those things 168 168
into a custom dictionary list. 169 169
Then, my password cracking program would take that list 170 170
and add different things to it as a form of brute force. 171 171
For example, let's say your favorite sports team 172 172
was the Ravens up in Baltimore. 173 173
I might use two words as part of my dictionary list: 174 174
Baltimore and Ravens. 175 175
Then, the program will try things like Baltimore123 176 176
or Ravens911 or whatever. 177 177
And they'll substitute in symbols and numbers 178 178
and add things to it and make different combinations, 179 179
trying to figure out what your password is. 180 180
This is essentially a modified version of brute force 181 181
but it does speed up the time it takes to crack a password 182 182
if I use the right keywords 183 183
because I'm giving it some sort of a starting point, 184 184
instead of picking everything out at random. 185 185
But again, this isn't 100% effective 186 186
because if I choose something like Ravens 187 187
and you didn't use that as part of your password stem, 188 188
I'm not going to ever get there 189 189
because it's not a traditional brute force attack 190 190
where I try every single possible combination. 191 191
The next factor of authentication we have 192 192
is known as something you have, 193 193
also known as a possession factor. 194 194
Now, this can be something like a smart card, 195 195
which stores a digital certificate on a card 196 196
that you have to insert in your computer 197 197
and then unlock it using a pin. 198 198
Now, this means you have something you have, the card, 199 199
and something you know, the pin, 200 200
so we have two factors of authentication. 201 201
Now, another thing you might use 202 202
is something like an RSA key fob. 203 203
Now, an RSA key fob is going to change a number 204 204
on a little device that's in your pocket 205 205
every 30 to 60 seconds. 206 206
Now, when you go to log into your machine, 207 207
it's going to ask for your username and password 208 208
and a rotating pin number 209 209
because that pin number's provided by that key fob, 210 210
so this means you have something you know, 211 211
that knowledge factor because your username and password 212 212
but you also have something you have, 213 213
this key fob by typing in that rotating pin number. 214 214
By combining those two things together, 215 215
I now have two-factor authentication. 216 216
Another option we have is using something like an RFID tag. 217 217
Now, some employers have badges that you wear 218 218
and there's an RFID tag built into it. 219 219
To log into your system, 220 220
you tap your badge onto the computer, 221 221
that's something you have, 222 222
and then you enter a pin number or password, 223 223
something you know. 224 224
Again, this gives you a good 225 225
two-factor authentication solution. 226 226
Something you have and something you know. 227 227
The next factor authentication we have is something you are. 228 228
We refer to this as an inheritance factor. 229 229
Now, inheritance factors are things like fingerprints 230 230
because only I have my fingerprints. 231 231
I can also use retina scans because only I have my eyes 232 232
or a voiceprint because only I talk the way I talk 233 233
and a computer can actually tell my voice 234 234
versus somebody who is imitating my voice. 235 235
My voice print is going to be unique to me. 236 236
All these things can be used as an inheritance factor 237 237
or something you are. 238 238
Now, these types of factors are not as commonly used 239 239
in most organizations 240 240
because a lot of people feel it's intrusive. 241 241
For example, if every time I were to log into my computer, 242 242
I had to put my eyeball up to a scanner, 243 243
that's a little creepy, right? 244 244
And I probably wouldn't want to 245 245
log into my computer very often. 246 246
So instead, most of the time 247 247
we're going to use two-factor authentication 248 248
with something you know and something you have 249 249
because it is a lot easier. 250 250
But if you work in a high security environment, 251 251
you might find a door lock or something of that nature 252 252
that it's going to rely on a thumbprint or a retina scan. 253 253
Now, the next factor we have is something you do, 254 254
which is known as an action factor. 255 255
This might be the way you sign your name, 256 256
the way you draw a particular pattern on a screen, 257 257
or the way you say a particular passphrase. 258 258
All these are something you do that's unique to you. 259 259
That action can be measured by a computer 260 260
and used for authentication. 261 261
Usually, you don't want to use this 262 262
as a single factor, though, because it is prone to error. 263 263
So instead, you'll add it with something you know 264 264
and that will give you two-factor authentication 265 265
because people can forge your name and the way you sign 266 266
but generally, the way you press 267 267
and the way you put pressure 268 268
on certain parts of your signature is more unique to you. 269 269
Our final factor is somewhere you are. 270 270
This is known as a location factor. 271 271
Now, we do this one of two ways. 272 272
We can either use geotagging or geofencing. 273 273
When we do a geotagging, 274 274
that's going to be based off your GPS or your phone 275 275
or the device you're using. 276 276
For example, if I'm trying to log into my local server 277 277
that uses geotagging and it's going to check my coordinates 278 278
and my GPS, and it sees that I'm sitting in Moscow 279 279
instead of being in Puerto Rico, 280 280
that means it's going to reject me 281 281
because it realizes it's not Jason. 282 282
Jason's not in Moscow, he's sitting in Puerto Rico, 283 283
so that person doesn't need to be on our network. 284 284
Now, the other way we can do this is by using geofencing. 285 285
Geofencing is used more 286 286
when we actually want to track a device 287 287
and see if it's going to leave a certain area. 288 288
And if it does leave that area, 289 289
which is set off by GPS coordinates, 290 290
it will then send an alert and let us know. 291 291
So maybe we have a bunch of mobile phones 292 292
for all of our employees 293 293
but we don't want them to use them 294 294
anytime they leave our city. 295 295
Well, we can set up a GPS location coordinates 296 296
around our city borders 297 297
and any time they cross those city lines, 298 298
it would actually send up an alert 299 299
back to our mobile device management suite 300 300
to say this person is no longer within our coverage area. 301 301
This is basically a location factor. 302 302
It's an additional way to provide protection, 303 303
additional authentication, 304 304
in addition to something like a username and password 305 305
and makes sure your devices are within the range 306 306
of where you want them to be used.