Something You Have Authentication

Something You Have: Authentication Something You Have: Authentication • Another type of authentication credential is based on the approved user having a specific item in his possession (something you have). • something you have used along with passwords • Because this involves more than one type of authentication this type of authentication credential is called multifactor authentication (MFA). • Using just one type of authentication is called singlefactor authentication, • Using two types is called two-factor authentication (2FA). Something You Have: Authentication • The most common items that are used for this type of authentication are • specialized devices (smart cards and windowed tokens) • smartphones, and • security keys. Specialized Devices –(Smart Cards) • A smart card is a credit-card-sized plastic card that can hold information to be used as part of the • authentication process • require that the card reader • that is connected to the computer • integrated circuit chip, bar code and magnetic stripe disadvantages to smart cards • must have a specialized hardware reader and device driver software installed • a magnetic strip (called magnetic stripe cards) are subject to unauthorized duplication called card cloning. • Stealing this information is often done by a process called skimming, in which a threat actor attaches a small device that fits just inside the card readers so that when the card is inserted and removed, both the actual reader and the skimming device capture the information from the magnetic strip. Windowed Tokens • a small device (usually one that can be affixed to a keychain) with a window display, the value dynamically changes • This value is a one-time password (OTP), which is an authentication code that can be used only once or for a limited period of time. one-time password (OTP) • There are two types of OTPs. • A time-based one-time password (TOTP) changes after a set period of time. • the windowed token and a corresponding authentication server share an algorithm (each user’s token has a different algorithm), and the token generates a code from the algorithm once every 30 to 60 seconds. • (This code is valid for only the brief period that it is displayed on the token.) • The user logs in by entering a username along with the code currently being displayed on the token. • When the authentication server receives it, the server looks up the algorithm associated with that specific user, generates its own code, and then compares it with what the user entered. If they are identical, the user is authenticated. • HMAC-based one-time password (HO TP) • Instead of changing after a set number of seconds, an HMAC-based one-time password (HO TP) password is “event driven” and changes when a specific event occurs, such as when a user enters a personal identification number (PIN) on the token’s keypad, which triggers the token to create a random code. For example, after entering the PIN 1729, the code 833854 is displayed. • While windowed tokens have some advantages, such as creating dynamic OTPs, they are considered difficult (cumbersome) to use. Once an OTP is received, it must then be manually entered on the endpoint device. Because the OTP is valid for only a short time, the user must enter it quickly. Smartphones • Phone call. An automated phone call to the user’s smartphone asks if the user has requested to log in and, if so, to press a digit on the keypad for approval or to decline if the user has not just tried to log in. • SMS text message. Another option is for the user to receive an OTP in an SMS text message. The user must then manually enter the OTP. • Authentication app. An authentication app can be installed on the smartphone to authenticate the user. When the app is first installed, the user goes through a verification process. Whenever a user attempts to log in to an account by entering a username and password, a message is displayed on a specified phone (called a push notification) through the authentication app that asks the user to approve or deny the request. Authentication app Security Keys • Dedicated token key, more commonly called a security key • a security key is a dongle that is inserted into the USB or held near the endpoint( Near Field Communication, or NFC) • It contains all the necessary cryptographic information to authenticate the user.