>> Authentication: The learning objectives for
this lesson are to describe
credential management and password systems,
and to explore a federated trust methods.
Let's get started. Password policies.
We've all dealt with passwords and where we're
told we have to use complex passwords.
This is how those complex passwords are described.
First we have password length: the
minimum or maximum number of characters.
Then password complexity: no use of username,
must contain upper and lower letters,
numbers, and characters.
Password aging: select a new password after a set time.
Password reuse and history:
you may not use the same password,
and then we also determine how
many of those old passwords are blocked.
Character classes: we have 94 possible characters,
26 upper, 26 lower,
10 numbers, and then 33
special characters or punctuation.
Finally, auditing: this ensures that
passwords comply with our policies.
Also, it's important to know that we do not
want to store our passwords using reversible encryption.
This is when passwords are stored in
a way that can be decrypted.
This is a massive security risk
and they should never be used.
This is why strong passwords are necessary.
This chart gives us
the estimate of how long it would take to
crack a password given certain circumstances.
On the left, we have the number of characters from 4-18.
Then going across the top of the right,
we have numbers only lowercase letters,
upper and lowercase letters, numbers,
upper and lowercase letters,
and then finally, numbers,
upper and lowercase letters and symbols.
You can see why it's very important to use
longer passwords that contain everything from numbers,
upper and lower, and punctuation.
Some of these can be cracked so quickly that
even a long password that is say
15 characters long that's only numbers,
or 10 characters with
lowercase n numbers is only 58 minutes.
It's very important to oppress
upon users that they need to use
longer passwords with all
of the possibilities that they could use: upper,
lower, numbers, and special characters.
Instructor's side note: NIST special publication,
800.63b, has changed some of
the passwords sacred cows that have
been used for a very long time.
For example, password changes and password complexity.
What NIST is now saying is
that strong method for making passwords that
users can easily remember is to
take three or four random words and put them together.
For example, horse, stove, and strawberry.
This is 20 characters long.
If we add some capitalization, a number,
and a character, we can make
this password nearly uncrackable.
In fact, according to security.org,
this password would require
200 sextillion years to crack.
The reason NIST did this is they
determined that if a strong password was
chosen upfront that met these type of guidelines,
it doesn't need to be changed often,
and it doesn't have to be super complex.
For example, the password here,
horsestove@strawberry by adding just a few changes to it,
is very resistant to cracking.
Privileged access management: This
protects against credential theft
and then also credential misuse.
People, processes,
and technology to secure, control, monitor,
and audit identities used by people, services and apps.
It also stores credentials in a secure vault
that requires additional authentication to be used.
Some examples of this would be CyberArk,
Beyond Trust, and Centrify.
Federated trust models: Federation;
it's trusting accounts made
and use by another organization.
This allows these organizations
to connect across each other.
Example is using your Google ID
to login to other websites.
OpenID allows for a single ID to be used by
anyone in the participating OpenID network websites.
OpenID has authentication to OAuth 2.0.
Security Assertion Markup Language,
or SAML: This is
a protocol for cloud and network federation.
Attestations or authorizations are written in XML.
Communications are performed over HTTP/HTTPS,
and simple object access protocols or SOAP.
Secure tokens are signed
using XML signatures specifications.
Examples of this would be Amazon AWS,
the customers can access apps,
and resources on the AWS
without the need to create AWS accounts.
Federated trust models: Shibboleth based on SAML,
often used by universities
and public service organizations.
The user contacts the Shibboleth site via SAML.
The site redirects to
an identity provider
that verifies using SAML information.
The identity provider responds to
the site with authentication information,
and then the site validates and gives
access based on the user SAML information.
Transitive trust: If resource A,
trust resource B,
and B trust C,
than A trust C.
A good example of this in action is Active Directory.
Security Assertion Markup Language or SAML
: We first start with user accesses Salesforce,
and then Salesforce redirects
itself to Amazon for authentication.
Amazon authenticates the user
and allows the user to access Salesforce.
This is a simplified breakdown of how SAML works.
Let's summarize what we went over in this video.
We discussed credential management.
We explained the importance of
strong passwords and password policies,
and we discussed the various types
of federated trust models.
Let's do some example questions.
Question 1: This
describes storing passwords in
a way that passwords can be decrypted.
Reversible encryption.
Question 2: Blank is based on SAML,
and is often used by
universities and public service organizations.
Shibboleth. Question 3:
Blank is designed to
protect against credential theft and misuse.
Privileged Access Management.
Question 4: which federated trust method allows users
to have a single account for
all sides participating in the same system?
OpenID. I hope this video
was useful to you, and I will see you in the next one.