In this lesson,
we're going to talk about the importance
of using multifactor authentication.
So what exactly is multifactor authentication?
Well, multifactor authentication
means that you're authenticating or proving your identity
using more than one method.
For it to be multifactor,
you have to at least two methods or more.
You can have two, three, four, or five.
Now, when you talk about different methods,
we're talking about different categories.
We're talking about something you know,
something you have, something you are,
something you do, or somewhere you are.
We're going to talk about each of these in this lesson.
Now our first one is something you know,
and this is the most common factor,
and it's known as a knowledge factor.
This is because you have to know something.
If it's something you know,
this would be something like a username, a password,
a PIN, or answers to personal questions,
all of these are considered knowledge factors.
If you know it and I can try to figure it out,
then I would know it, and now I have that knowledge too,
and I can authenticate as you.
Now one of the common questions I see
inside the Network+ exam is asking you,
what would be considered two-factor authentication?
Now one of the answer choices they'll give you
will be something like a username and a password.
Now a lot of students will see this and they'll think,
"Hey, this is a username and a password.
That must be two factors, right?
Because I have two things."
But that's not true,
a username and password both come from this factor,
which is known as the knowledge factor or something we know,
therefore, it's still considered a single factor.
Now this is not going to give you the best security,
so instead we want to add a second factor
to get us 2FA, two-factor authentication,
or multifactor authentication.
So what are some weaknesses with passwords?
Well, the most common weakness
is that people don't change default credentials.
You might have a default password on a brand new system,
like a wireless router or access point,
and the password is password,
and nobody ever bothers to change it.
I've seen this time and time again
in my penetration tests.
Don't do that.
Whenever you get a new device,
you need to go in and change those default credentials,
because default credentials are really easy to guess.
Also, people will use common passwords
and that becomes a big issue.
Now when you talk about common passwords,
that means using the same password across multiple devices
or using a common phrase or word as their password.
Things like love, and password, and secret,
those things are just way too common.
Now every year there's a dictionary
that comes out called the attacker's dictionary,
and it shows all the commonly used passwords.
We can use those passwords in that list
as part of a dictionary attack
to be able to find your password
pretty darn quickly in most cases.
Now another issue we have is that people use weak
or short passwords.
If you're going to use something like dog, or puppy,
or cupcake, or dog123,
these are all short and weak passwords.
Anything that is a standard dictionary word
is completely bad and you should not use it.
Anything less than eight characters is also pretty bad.
You really want to make sure you have a nice,
long, strong, secure password,
and to do that, you need uppercase letters,
lowercase letters, numbers,
and special characters all mixed together,
this will help increase the security of your password,
and you want to make sure it's a long password.
Now if you're only going to use a single-factor authentication,
like a username and a password,
at least make sure you're using a long, strong password.
The reason this is that attackers know
that they can break our passwords over time.
There's lots of different attacks we can use,
like a dictionary attack, a brute force attack,
or a hybrid attack.
Now a dictionary attack occurs when the attacker
tries to guess the password by checking every single word
or phrase contained within a word list,
which we call a dictionary.
Now an attacker's dictionary
isn't like the dictionary you used in high school,
it doesn't contain just real words.
Many attacker's dictionaries contain things
like the word password,
but they'll also sub it out
and have the A becoming an @ symbol
or the S becoming a dollar sign,
and they'll have lots of different combinations
of these in this single dictionary.
When the attacker tries to crack your password using a list,
we consider it a dictionary attack
whenever there's a list involved,
even if they're not real words.
So the best defense against a dictionary attack
is to not use anything that looks like a regular word.
Even if you start substituting in symbols for letters,
that still looks like a regular word
and it's probably in an attacker's dictionary.
On the other hand, if a dictionary attack isn't successful,
the attacker may move on and try to do a brute force attack.
Now, with a brute force attack,
they're going to try every possible combination
until they figure out your password.
For example, let's say your password was a PIN
and it's four digits long.
Well, the attacker could start out with 0000,
then try 0001, then 0002,
and they keep going up
until they finally get your four-digit code,
which may be something like 5246, or whatever it was.
The thing is that with a brute force attack,
they will always be successful, eventually,
it's just a matter of time,
and so the key here is to prevent them
by creating longer and more complicated passwords.
Because the longer, more complicated the password is,
the longer it's going to take an attacker to guess it
using brute force
and going through all the possible combinations.
For example, if you have an eight-character password,
even if it has uppercase, lowercase,
numbers and symbols in it,
it will take less than a few days to crack that password
using a decent graphics card.
Now, if I raise that up to nine characters,
it will take me about five days to crack it.
With 10 characters, it becomes four months,
11 characters, 10 years,
and 12 characters about 200 years.
You can see there's this exponential curve here,
but remember, computers are always getting faster
and better at cracking every single day.
So all these numbers I just gave you,
by next year, you can cut them in half,
and the year after that, cut it in half again,
and it'll keep going down and down and down,
so we have to get longer and stronger passwords.
As a good rule of thumb,
you want your password to be at least 12 characters minimum
for good security.
Now the final method a hacker can use
is what's known as a hybrid technique,
this is a mixture of a dictionary and a brute force method.
Now, basically, the attacker tries to gather keywords
that would relate to your life,
and then make their own custom dictionary list.
For example, I might go on Facebook
and try to find out your spouse's name,
or your dog's name, or your favorite sports team,
and then I put all the words related to those things
into a custom dictionary list.
Then my password cracking program would take that list
and add different things to it as a form of brute force.
For example, let's say your favorite sports team
was the Ravens up in Baltimore.
I might use two words as part of my dictionary list,
Baltimore and Ravens.
Then the program will try things like Baltimore123,
or Ravens911, or whatever,
and they'll substitute in symbols and numbers,
and add things to it and make different combinations,
trying to figure out what your password is.
This is essentially a modified version of brute force,
but it does speed up the time it takes to crack a password
if I use the right keywords,
'cause I'm giving it some sort of a starting point
instead of picking everything out at random.
But again, this isn't 100% effective,
because if I choose something like Ravens
and you didn't use that as part of your password stem,
I'm not going to ever get there,
because it's not a traditional brute force attack
where I try every single possible combination.
The next factor of authentication
we have is known as something you have,
also known as a possession factor.
Now this can be something like a smart card,
which stores a digital certificate on a card
you have to insert into your computer,
and then unlock it using a PIN.
Now this means you have something you have, the card,
and something you know, the PIN,
so we have two factors of authentication.
Now another thing you might use
is something like an RSA key fob.
Now an RSA key fob is going to change a number
on a little device that's in your pocket
every 30 to 60 seconds.
Now when you go to log into your machine,
it's going to ask for your username and password
and a rotating PIN,
because that PIN is provided by that key fob.
So this means you have something you know,
that knowledge factor, because your username and password,
but you also have something you have,
this key fob, by typing in that rotating PIN.
But combining those two things together,
I now have two-factor authentication.
Another option we have is using something like an RFID tag.
Now some employers have badges that you wear
and there's an RFID tag built into it.
To log into your system,
you tap your badge onto the computer,
that's something you have,
and then you enter a PIN or a password, something you know.
Again, this gives you a good
two-factor authentication solution,
something you have and something you know.
The next factor we have is something you are,
now this is also referred to as an inherence factor.
Now the inherence factor is things like fingerprints,
because only I have my fingerprints,
or retina skin, because only I have my eyes,
voice prints are also included in this,
because the way I talk
is different than the way other people talk,
and my voiceprint is unique to me.
Now all of these things can be used as an inherence factor
or something you are.
Now these are not commonly used
like the way you see something you know,
or something you have,
because something you are, these inherence factors,
are very intrusive when you're dealing with them.
For instance, if every time I wanted to log
into my computer, I had to put my eyeball up to a scanner,
that's pretty intrusive,
and I wouldn't want to log into my computer very often.
So instead, most two-factor authentication schemes
are going to be using something you know,
or something you have.
Now something you are is often going to be used
in high-security environments,
usually something like a door lock
or something like that to keep people out
of a very secure room, like a server room,
that holds top secret information.
Now the next factor we have is something you do,
which is known as an action factor.
This might be the way you sign your name,
the way you draw a particular pattern on a screen,
or the way you say a particular passphrase,
all these are something you do that's unique to you.
That action can be measured by a computer
and used for authentication.
Usually you don't want to use this as a single factor though,
because it is prone to error.
So instead you'll add it with something you know,
and that'll give you two-factor authentication,
because people can forge your name and the way you sign.
But, generally, the way you press
and the way you put pressure on certain parts
of your signature is more unique to you.
Our final factor is somewhere you are,
this is known as a location factor.
Now we do this one of two ways,
we can either use geotagging or geofencing.
When we deal with geotagging,
that's going to be based off your GPS, or your phone,
or the device you're using.
For example, if I'm trying to log into my local server
that uses geotagging and it's going to check my coordinates
and my GPS and it sees that I'm sitting in Moscow
instead of being in Puerto Rico,
that means it's going to reject me
because it realizes it's not Jason.
"Jason's not in Moscow, he's sitting in Puerto Rico,
so that person doesn't need to be on our network."
Now the other way we can do this is by using geofencing.
Geofencing is used more when we actually want to track
a device and see if it's going to leave a certain area.
And if it does leave that area,
which is set off by GPS coordinates,
it will then send an alert and let us know.
So maybe we have a bunch of mobile phones
for all of our employees,
but we don't want them to use them
anytime they leave our city.
Well, we can set up GPS location coordinates
around our city borders.
And anytime they cross those city lines,
it would actually send up an alert
back to our mobile device management suite to say,
"This person is no longer within our coverage area."
This is basically a location factor,
it's an additional way to provide protection,
additional authentication in addition
to something like a username and password,
and make sure your devices
are within the range of where you want them to be used.