内容访问控制sch02.pdfVIP

Objectives • Identification and Authentication • Centralized Access Control • Decentralized Access Control • Access Control Attacks • Testing Access Controls Controlling Access Identification and Authentication • Identification: unproven assertion of identity – “My name is…” – Userid • Authentication: proven assertion of identity – Userid and password – Userid and PIN – Biometric Authentication Methods • What the user knows – Userid and password – Userid and PIN • What the user has – Smart card – Token • What the user is – Biometrics (fingerprint, handwriting, voice, etc.) How Information Systems Authenticate Users • Request userid and password – Hash password – Retrieve stored userid and hashed password – Compare • Make a function call to work based authentication service How a User Should Treat Userids and Passwords • Keep a secret • Do not share with others • Do not leave written down where someone else can find it • Store in an encrypted file or vault – Use RofoForm How a System Stores Userids and Passwords • Typically stored in a database table – Application database or authentication database – Userid stored in intext • Facilitates lookups by others – Password stored encrypted or hashed • If encrypted, can be retrieved under certa onditions – “Forgot password” function, application s to user • If hashed, cannot be retrieved under any circumstance (best method) Password Hashes • Cain, Cracker top tab, right-click empty space, Add to List • LM hash is weak, no longer used in Win 7 • NT h