What I want to cover in this episode is identification authorization and authentication.
Now when we talk about these three the best way to really understand it is through an analogy.
So I'm actually buying myself a ticket to go to the theater right now and I'm going to print out my
confirmation code.
Let's go to the theater.
And let me show you how these three work. Two tickets for La Traviata please.
Now before she's going to give me any tickets we are going to have to get in essence authenticated.
Now the first step I'm going to have to do here is I'm going to provide some form of identification
in this case.
I'm just going to provide a driver's license now because the ticket lady is a human being.
This is an easy way for her to identify me is just by looking at the driver's license.
But it still doesn't mean I'm authenticated to get some tickets in order for me to do.
Yes.
In order for me to do that I'm going to have to pull out my confirmation number that I printed out on
my printer earlier. Now between my identification and my confirmation number
I've actually performed proper authentication.
Thank you very much.
And now I've got my tickets.
Let's go sit down.
OK row T and my seats are 14 and 15.
OK.
Good.
I think I might be here a little early.
The important thing to remember for the security plus is the difference between identification authentication
and authorization. Identification just proves who I am to the authenticating system. Authentication itself
takes place by me proving that I have rights to that system through passwords smart cards retinal scanners
whatever it might be.
And then authorization simply means what rights do I have to the system once I've been authenticated.
All right.
So let's do this all over again except this time let's do it in a more computer kind of world.
I'm going to watch the show.
Ah, La Traviata.
Who doesn't enjoy a little bit of Verde every now and then.
OK.
Well anyway we're back in the studio now and what I want to do is kind of make sure we understand there's
some issues when it comes to identification authorization and authentication.
The challenge we have is that computers aren't people.
I can't go to a lady in a ticket booth and just show them a driver's license and confirmation number
and in essence get my tickets.
Instead what we do is we have what are called authentication factors.
Now there are three big authentication factors that you're going to be seen on security plus. The first
one is something you know and that's something like a password for example would be something you know.
The next one is something you have.
And that means things like a smart card or something that you actually have on your person that you
can use to authorize you.
And the last one is something about you and that's what we call biometrics that's going to be things
like retinal scanners and things that actually measure the veins in your palm all kinds of cool stuff
like that.
Anyway let's go ahead and start with the first one and that is something you know. So the best example
is good old passwords.
So here we are at a typical log in screen and you could see that I have my user name that I type in and
my passwords were all pretty comfortable with something like that.
But passwords aren't the only type of something you know.
Another great example are going to be pin codes. Now we see pins all over the place.
One of my favorite ones is here on my phone right here.
So what I'm going to do is you guys are going to fuzz all this out.
Right.
OK so what I'm going to punch in my password one two three four.
It's not a password it's a PIN.
I know.
OK.
That's incorrect.
Like I was really going to let you guys see my PIN code,
come on. Now we see PINs all over the place.
We see them on phones a lot.
ATM machines.
But again that's a great example of something you know.
In fact at first certain Department of Justice folks I work with not only when you walk up to a machine
do you have to type in a password but you actually have to type in a PIN separately depending on what
type of authenticating system you might have.
But that's not the only types of something you know.
There's two more I want to look at.
First of all let's take a look at captcha.
We've probably all seen a captcha screen.
Most the time these tend to pop up like on Web sites where you're logging in a few too many times and
you're making the authenticating process a little bit nervous.
So what they're going to do is they're going to let you type in your username and password again but
you're going to have to type in the captcha.
You know what that captcha says.
The idea here is that it's preventing evil computer programs that can just keep logging in over and
over again from being able to log in.
So that's captcha.
Now the last one I want to take a look at is right here and this is going to be security questions.
There's a good chance most of us have seen security questions too. Security questions usually pop up for
example when you've forgotten your password or something like this and that allows for an automatic
password retrieval type system simply by you remembering the name of your first dog or your mother's
maiden name or school that you graduated from whatever it might be.
So you need to be careful on the security plus exam right here.
It's easy to remember that something you know would be an example like a password or a pin.
But also remember that captcha and security questions are included in something you know.
OK.
The next one is something you have now.
When we talk about something you have We're going to talk about two things in particular that you're
going to see on security plus the first one is called a Smart Card.
And I seem to be out of smartcards right now but I've got a picture of one right here on the screen.
Let's take a look at this.
Now this is a very typical smart card that you'll see used in like a lot of federal organizations and
stuff like that.
The important thing about a smart card is embedded somewhere on that smart card is a chip that holds
a unique identifying code.
And when you insert this or when you wave it over a sensor or whatever it might be it provides that
code to the authenticating body.
Now smart cards are great but the last one I want to show you is known as an RSA key.
Now an RSA key.
It can be a little device that its got a number or it can be a piece of software.
And I actually have one here so let me show you how an RSA key works.
Now I want you to watch this very closely you'll see this 8 digit code, now watch,
OK you see it just change? An RSA token or an RSA key is a piece of software or an actual
physical key you can get that stores a secret code of some form.
It then takes that secret code and performs some magic little voodoo on it and will generate a value
that changes.
It depends there's no law of physics.
Every 30 seconds every 60 seconds.
So the only way that another device can authenticate this is that if it also has that secret code and
it will go ahead and run the same mumbojumbo and if it comes up with the same value you are in good
shape.
Now the last one is something about you and when we talk about something about you we're talking about
something about you physically.
So we could have fingerprint scanners or iris patterns or even the pattern of the veins in your wrist
can be used to identify you uniquely.
Now there's a bunch of these that are out there and if you've got a late generation iPhone 5 there's
fingerprint scanners and things like that.
But what I have here is my buddy Scott has a cool laptop and on this laptop is facial recognition. So
to use this all I'm going to have to do and this allows him to log into his laptop.
So what I'm going to do here is I'm going to fire the laptop up. So on his laptop
he's actually just using the camera here to recognize me.
Now if you look on the screen you see it's actually trying to find Scott Jernigan so we might have a bit
of a problem.
--Hey! Where's my laptop?
Oh sorry Scott.
--Mike.
I was just trying to show people how security plus covers things like something you are. Pretty slick
huh Mike? It is pretty slick.
Thank you for letting me steal your laptop.
Thanks you all done.
We're done.
Take it away Jeeves.
Bye. Bye.
Look forward to stealing more from you in the future.
OK so that is a great example of something about you.
Now there are two more on the security plus we need to talk about one of them is called something you
do.
And when we talk about something you do there are actually authentication programs like where if you
log in your password for example.
Not only do you have to have the right password but literally the rhythm of your typing can be used
to verify that it's actually you're kind of typing style which is pretty cool.
Now the last one I want to talk about is called Somewhere you are. And when you talk about somewhere
you are
as it implies it has to do with geography.
So the best way to show you this is let's go buy some gasoline. Now somewhere you are has to do, well,
we see it in a lot of places on authentication.
The one place we see it a lot is in the credit card world for example here I am buying gas and it wants
me to enter my zip code. Yay it works.
So I'm going to put regular in here. Now
the other thing to remember about some where you are is that this is also used by credit card companies
to detect fraud.
So for example while I'm here in Houston Texas if someone else we're trying to use his card in
Chattanooga Tennessee.
That would definitely set off some alarms at
the credit card company.
Those are the types of authentication really identifications that we run into.
So the challenge that we start to get is that we do a lot of authenticating all over the place.
And if I've got one network over here and then there's like a company and we access their data a lot
for some reason or another the hassle of authenticating from one place and then another can be a bit
of a problem.
So with a lot of operating systems in fact.
Well let me rephrase that with Microsoft Windows in particular.
We can actually create authentications based on trust.
So here I've got three different networks.
And in this particular situation these are three different companies that access this one company's
database.
So what becomes interesting is that we can set up what are known as a federated trust situation and
when we say federated trust it's basically this system saying to this system if you've got somebody
you trust then I'll trust them as well.
And what we can do this sets up in Windows fascinatingly under active directory is we can set something
up and we can actually establish a trust we can connect to another Windows domain and say this domain
trust this domain and it can automatically create these types of federated transitive trusts.
The last thing to throw in here is the idea of what we call multi-factor authentication.
You would never ever use a biometric as a primary and only source of authentication.
Typically what you're going to do is pretty much everything works with a username and password or it
could be a pin number.
So if you're going to authenticate on a system you're going to use a fingerprint scanner and you're
going to type in the username and password. You're going to type in the name and password and you're
going to use a hardware token.
So we're always doing the multi-factor form of authentication.