Authentication

Authentication is the process of recognizing a user’s identity. Authentication keeps invalid users out of databases, networks, and other resources. These types of authentication use factors, a category of credential for verification, to confirm user identity.

Types of authentication

i. Single-Factor/Primary Authentication

The most common form of authentication, Single-Factor Authentication, is also the least secure, as it only requires one factor to gain full system access. It could be a username and password, pin-number or another simple code. While user-friendly, Single-Factor authenticated systems are relatively easy to infiltrate by phishing, key logging, or mere guessing.

ii. Two-Factor Authentication (2FA)

Two-factor authentication reinforces security efforts. It is an added layer that essentially double-checks that a user is, in reality, the user they’re attempting to log in as—making it much harder to break.

With this method, users enter their primary authentication credentials (like the username/password mentioned above) and then must input a secondary piece of identifying information.

Possible secondary factors are a one-time password from an authenticator app, a phone number, or device that can receive a push notification or SMS code, or a biometric like fingerprint (Touch ID) or facial (Face ID) or voice recognition.

iii. Multi-Factor Authentication (MFA)

Multi-factor authentication is a high-assurance method, as it uses more system-irrelevant factors to legitimize users. Like 2FA, MFA uses factors like biometrics, device-based confirmation, additional passwords, and even location or behavior-based information (e.g., keystroke pattern or typing speed) to confirm user identity. However, the difference is that while 2FA always utilizes only two factors, MFA could use two or three, with the ability to vary between sessions, adding an elusive element for invalid users.

Authentication protocols

Authentication protocols are the designated rules for interaction and verification that endpoints (laptops, desktops, phones, servers, etc.) or systems use to communicate. 

Selecting the right authentication protocol for an organization is essential for ensuring secure operations.

i. Password Authentication Protocol (PAP)

PAP is the least secure protocol for validating users, due mostly to its lack of encryption. It is essentially a routine log in process that requires a username and password combination to access a given system, which validates the provided credentials.

ii. Challenge Handshake Authentication Protocol (CHAP)

CHAP is an identity verification protocol that verifies a user to a given network with a higher standard of encryption using a three-way exchange of a “secret.”

First, the local router sends a “challenge” to the remote host, which then sends a response with an MD5 hash function. The router matches against its expected response (hash value), and depending on whether the router determines a match, it establishes an authenticated connection—the “handshake”—or denies access.

It is inherently more secure than PAP, as the router can send a challenge at any point during a session, and PAP only operates on the initial authentication approval.

iii. Extensible Authentication Protocol (EAP)

This protocol supports many types of authentication, from one-time passwords to smart cards. When used for wireless communications, EAP is the highest level of security as it allows a given access point and remote device to perform mutual authentication with built-in encryption. It connects users to the access point that requests credentials, confirms identity via an authentication server, and then makes another request for an additional form of user identification to again confirm via the server—completing the process with all messages transmitted, encrypted.

Audit

A cyber security audit is a systematic and independent examination of an organization’s cyber security. An audit ensures that the proper security controls, policies, and procedures are in place and working effectively.

Audits play a critical role in helping organizations avoid cyber threats. They identify and test organizations security in order to highlight any weaknesses or vulnerabilities that could be exploited.

A cyber security audit focuses on cyber security standards, guidelines, and policies. Furthermore, it focuses on ensuring that all security controls are optimized, and all compliance requirements are met.

Cyber Security audit evaluates:

• Operational Security (a review of policies, procedures, and security controls)
• Data Security (a review of encryption use, network access control, data security during transmission and storage)
• System Security (a review of patching processes, hardening processes, role-based access, management of privileged accounts, etc.)
• Network Security (a review of network and security controls, anti-virus configurations, security monitoring capabilities)
• Physical Security (a review of role-based access controls, disk encryption, multifactor authentication, biometric data, etc.)

Benefits of a cyber security audit

A cyber security audit is the highest level of assurance service that an independent cyber security company offers.

An audit adds an independent line of sight that is uniquely equipped to evaluate as well as improve your security.

Some of benefits of performing an audit are:

• Identifying gaps in security
• Highlight weaknesses
• Compliance
• Reputational value
• Testing controls
• Improving security posture
• Staying ahead of bad actors
• Assurance to vendors, employees, and clients
• Confidence in your security controls
• Increased performance of your technology and security

Cybersecurity audits

There are four core cybersecurity audits:

1. Risk assessment
2. Vulnerability assessment
3. Penetration testing
4. Compliance audit

Risk assessment

Performing risk assessments will help recognise and prioritise risks and help identify different types of threats that your businesses could be vulnerable to.

Vulnerability assessment 

A vulnerabilities assessment works to identify weaknesses and possible risks. A vulnerabilities assessment will reveal areas that could be exploited to harm a business.

Penetration testing

Penetration testing simulates a hacking attempt. An expert will act as a ‘hacker’ and attempt to break into your company’s security system. By using different techniques, the hacker will attempt to bypass the security systems, which will highlight areas of the businesses IT security that needs improving/upgrading.

Compliance audit 

Compliance audits are necessary for businesses such as retail, finance, healthcare, or government who must comply with certain regulations. Compliance audits are to show that a company meets the laws required to conduct businesses safely in their industry.

Access Control

Access control is a data security process that enables organizations to manage who is authorized to access corporate data and resources. Secure access control uses policies that verify users are who they claim to be and ensures appropriate control access levels are granted to user.

Access control is used to verify the identity of users attempting to log in to digital resources.

Access control is crucial to helping organizations comply with various data privacy regulations.

Components of Access Control

Authentication

Authentication is the initial process of establishing the identity of a user. For example, when a user signs in to their email service or online banking account with a username and password combination, their identity has been authenticated. However, authentication alone is not sufficient to protect organizations’ data. 

Authorization

Authorization adds an extra layer of security to the authentication process. It specifies access rights and privileges to resources to determine whether the user should be granted access to data or make a specific transaction. 

Access

Once a user has completed the authentication and authorization steps, their identity will be verified. This grants them access to the resource they are attempting to log in to.

Manage

Organizations can manage their access control system by adding and removing the authentication and authorization of their users and systems. Managing these systems can become complex in modern IT environments that comprise cloud services and on-premises systems.

Audit

Organizations can enforce the principle of least privilege through the access control audit process. This enables them to gather data around user activity and analyze that information to discover potential access violations.

Access control can be categorized as

i. Physical Access Control: used to grant access to physical buildings and physical devices.

ii. Logical/Information Access Control: involves tools and protocols being used to identify, authenticate, and authorize users in computer systems. The access controller system enforces measures for data, processes, programs, and systems.

Types of Access Controls

There are several types of access controls that organizations can implement for access control. These include:

i. Attribute-based Access Control (ABAC)

ABAC provides access to users based on who they are rather than what they do. For example, the business unit they work in and how they were hired.

Attribute-based access control (ABAC) is an authorization system that defines access based on attributes associated with security principals, resources, and environment.

Attributes allow for an easier control structure because permissions can be based on the user’s type, location, department and so on, mirroring the physical aspects of the business.

ii. Discretionary Access Control (DAC)

DAC models allow the data owner to decide access control by assigning access rights to rules that users specify. When a user is granted access to a system, they can then provide access to other users as they see fit.

iii. Mandatory Access Control (MAC)

MAC places strict policies on individual users and the data, resources, and systems they want to access. The policies are managed by an organization’s administrator. Users are not able to alter, revoke, or set permissions.

iv. Role-Based Access Control (RBAC)

RBAC creates permissions based on groups of users, roles that users hold, and actions that users take. Users are able to perform any action enabled to their role and cannot change the access control level they are assigned.

v. Rule-based Access Control

A rule-based approach sees a system admin define rules that govern access to corporate resources. These rules are typically built around conditions, such as the location or time of day that users access resources. 

vi. Break-glass Access Control

Break-glass access control involves the creation of an emergency account that bypasses regular permissions. In the event of a critical emergency, the user is given immediate access to a system or account they would not usually be authorized to use.

Cyber Security safeguards

Cyber security safeguards are protective measures and controls prescribed to meet the security requirements specified for an information system.

Safeguards may include security features, management constraints, personnel security, and security of physical structures, areas, and devices.

The 3 categories for data protection safeguards are administrative, physical, and technical which are intended to ensure the confidentiality, integrity and availability of data files and records.

Administrative Safeguards

Administrative data protection safeguards or procedural controls refer to approved policies, procedures, standards and guidelines for running the business. From a security standpoint, they include access requests and approvals, periodic access reviews, supervision, and training.

Administrative safeguards are operational processes and procedures which are used to control an individual’s access to systems and data.

Physical Safeguards

Physical safeguards are physical measures, policies, and procedures to protect a covered entity’s electronic information systems and related buildings and equipment from natural and environmental hazards, and unauthorized intrusion. The standards under physical safeguards include facility access controls, workstation use, workstation security, and device and media controls. The Security Rule requires covered entities to implement physical safeguard standards for their electronic information systems whether such systems are housed on the covered entity’s premises or at another location.

Technical Safeguards

Technical data protection safeguards in a broader sense are the system controls and tools which are designed to protect data such as user authentication and passwords, account lockout during extended inactivity periods, and network intrusion prevention or detection controls. Another example of technical safeguard is system configuration to require strong passwords from our associates and lock the system down if too many unsuccessful attempts are made to gain entry to the system.

Technical Safeguards involve the hardware and software components of an information system, including:

• Identification and authentication
• Encryption
• Firewalls
• Malware protection
• Application design

Poor Cyber Security Awareness

Cyber security awareness is the combination of both knowing and doing something to protect a business’s information assets. When an enterprise’s employees are cyber security aware, it means they understand what cyber threats are, the potential impact a cyber-attack will have on their business and the steps required to reduce risk and prevent cyber-crime infiltrating their online workspace.

Mistakes commonly done due to lack of awareness are:

1. Opening Emails from Unknown People

Email is the preferred form of business communication Opening an unknown email, or an attachment inside an email, can release a virus that gives cybercriminals a backdoor into your company's digital home.

Solutions:

1.      Advise employees not to open emails from people they don't know.

2.      Advise employees to never open unknown attachments or links.

2. Having Weak Login Credentials

Repetitive passwords that use personal information, such as a nickname or street address, are a problem. Cybercriminals have programs that mine public profiles for potential password combinations and plug in possibilities until one hits. They also use dictionary attacks that automatically try different words until they find a match.

Solutions:

1.      Require employees to use unique passwords

2.      Add numbers and symbols to a password for increased security.

3.      Create rules that require employees to create unique, complex passwords of at least 12 characters; and change them if they ever have reason to believe that they have been compromised.

3. Having Access to Everything

In some cases, companies don't compartmentalize data. In other words, everyone from interns to board members can access the same company files. Giving everyone the same access to data increases the number of people who can leak, lose or mishandle information.

Solutions:

1.      Set up tiered levels of access, giving permission only to those who need it on each level.

2.       Limit the number of people who can change system configurations.

3.      Don’t provide employees with admin privileges to their devices unless they really require such set up. Even employees with the admin rights should only use them as needed, not routinely.

4. Lacking Effective Employee Training

Research shows the majority of companies do offer cybersecurity training. However, only 25% of business executives believe the training is effective.

Solutions:

Provide annual cybersecurity awareness training. Topics could include:

·         Reasons for and importance of cybersecurity training

·         Phishing and online scams

·         Locking computers

·         Password management

·         How to manage mobile devices

·         Relevant examples of situations

5. Not Updating Antivirus Software

Antivirus updates are important, should be handled promptly and shouldn't be left to employees.

Solutions:

1.      Set up all system updates to take place after work hours automatically.

2.      Don't let any employee, no matter what their title, opt out of this company policy.

6. Using Unsecured Mobile Devices

Every device should be password protected. If a device is lost or stolen, have a point of contact to report this to and steps taken to deactivate the device remotely.

Use endpoint security solutions to manage mobile devices remotely.

Don’t conduct confidential transactions using untrusted public Wi-Fi.

Unprotected Broadband Communications

Broadband is wide bandwidth data transmission which transports multiple signals at a wide range of frequencies and Internet traffic types that enables messages to be sent simultaneously, used in fast internet connections.

Broadband commonly refers to high-speed Internet access that is always on and faster than the traditional dial-up access. 

Broadband includes several high-speed transmission technologies such as:

    Digital Subscriber Line (DSL)

    Cable Modem

    Fiber

    Wireless

    Satellite

    Broadband over Powerlines (BPL)

Whenever a computer is connected to the Internet, there is risk of unauthorized access. When a dial-up connection is used, the risk is decreased because the duration of the connection is short for most users. For most users dialing into an Internet Service Provider (ISP), the user receives a different IP address with each logon. To penetrate a system connected via dial-up, an intruder would need the host’s current IP address and would have to compromise the host in a relatively short period of time before it was disconnected.

With dedicated broadband connections, a computer is connected to the Internet—and capable  of sending and receiving data Even though a user may be using the  machine only a few hours each day, the machine remains connected to the Internet and therefore vulnerable to attack.

Certain dedicated connections, particularly DSL lines, use dynamic IP addresses, similar to the way dial-up connections operate. While this may reduce the risk of an attacker targeting a specific user, it does not significantly reduce the risk to the average user. Most intruders arbitrarily scan the Internet for vulnerable systems. If a computer is powered on in the morning and powered off at night, the IP address will remain the same during the entire day.

An attacker who finds the machine during a random scan may potentially have several hours to penetrate the system.

An unsecure wireless connection is one you can access without a password. Public networks offered in places like cafes are often open. Although these provide free wireless Internet access, using public Internet comes with dangers.

The two types of public networks are ones that are left open by businesses and ones that are left open by individuals.

An open network from a business allows customers to use the Internet in the establishment -- such as coffee shops.

An open network in a home comes from a router that hasn't been secured.

Risks of using public networks

1. Theft of Personal Information

One of the most serious and common threats is theft of personal information. Personal information comes in many forms:

• Login credentials
• Financial information
• Personal data
• Pictures

If a hacker gets access to your computer or other personal devices through a compromised public WiFi connection, they could have free rein over everything stored. Once hackers obtained your details, they can log in to your personal pages and cause damage to your finances and reputation. If they don't get full access to the data on your computer, they could still intercept information you are sending over the Internet.

2. Man-In-The-Middle Attacks

A man-in-the-middle attack happens when someone "impersonates" a legitimate public WiFi service to trick you into connecting.

3. Unencrypted Connections

When you connect to a website that supports encryption, the data that goes back and forth gets encrypted using a secure key. If someone were to intercept that data without the possession of the key, they wouldn't be able to read it - the data would look like unreadable computer code.

When you are connected to a public WiFi network, anyone within range of your computer can intercept everything you send or receive. If you are connected to an unencrypted website, it will all be fully readable.

4. Packet Sniffing / Eavesdropping

Anyone connected to the same WiFi network as you can eavesdrop on what you send and receive using a tool called a packet analyzer or packet sniffer. These tools provide the possibility to view everything transmitted over the WiFi network, provided it is not encrypted.

5. Malware Distribution

Another threat that can occur while using public WiFi, is the implementation of malware on your device. Malware exists in many forms:

• Viruses
• Worms
• Trojan horses
• Ransomware
• Adware

If someone on the same public WiFi as you has bad intentions, they could plant malware on your computer if it is not protected properly. A suspect WiFi provider could use the hotspot itself to infect your computer with one or more of these threats.

6. Session Hijacking

Session hijacking is another public WiFi security threat. In this case, an attacker intercepts information about your computer and its connection to websites or other services. Once the attacker has that information, he can configure his own computer to match yours and hijack the connection.

Security in unprotected broadband communication

i. Use a Virtual Private Network – the information is encrypted

ii. Choose SSL(Secure Socket Layer) networks

iii. Switch off sharing

iv. Use firewalls to filter data transmission

v. use a security tool.

Weak Authentication

Authentication is the process of verifying the identity of a given user or client.

Weak Authentication refers to any situation in which the authentication mechanism's strength is insufficient in comparison to the importance of the assets being secured. It also covers situations where the authentication function is faulty or insecure.

Most vulnerabilities in authentication mechanisms arise in one of two ways:

• The authentication mechanisms are weak because they fail to adequately protect against brute-force attacks.
• Logic flaws or poor coding in the implementation allow the authentication mechanisms to be bypassed entirely by an attacker. This is sometimes referred to as "broken authentication".

Practices To Avoid Weak Authentication

Practices to Avoid Weak Authentication vulnerabilities include:

• Adopting a strong Password Policy and enforcing it consistently in all applications
• Using Two-Factor or Multi-Factor Authentication.
• Integrating an industry standard authentication framework.
• Adding Risk-based Authentication and escalating challenges as circumstances warrant.
• Ensuring that authentication is a pre-condition to access all application resources.
• Keeping the authentication token secure and limited in lifetime.