WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:0

00:06.320 --> 00:14.740
Okay, identity and access management.

00:14.770 --> 00:18.440
Identity and access management is
responsible for providing the right

00:18.470 --> 00:21.180
individual with the right
access at the right time.

00:21.210 --> 00:26.340
So it involves identity creation,
privilege assignments, and so forth.

00:26.370 --> 00:31.400
It involves authentication, authorization,
the management of the identity over its

00:31.420 --> 00:36.860
life cycle, the storing of
the identity in a repository.

00:36.890 --> 00:41.180
The identity repository may be
something like a directory service.

00:41.210 --> 00:43.000
It may be a third party provider.

00:43.030 --> 00:45.080
It may be provided by a third party

00:45.110 --> 00:50.300
organization, single sign ons,
federated identities, and that thing.

00:50.330 --> 00:53.200
The identity defined is a set of

00:53.230 --> 00:58.240
attributes linked to an entity that can
be stored and authenticated digitally.

00:58.270 --> 01:01.120
So for example, my user account, Eric, has

01:01.150 --> 01:05.820
different attributes, passwords, and
group memberships, and so forth.

01:05.850 --> 01:12.050
That user identity is typically
verified through an authentication.

01:12.080 --> 01:15.280
And again, that leads to authorization,
and that leads to accounting.

01:15.280 --> 01:16.930
Again, we're going to talk about those

01:16.960 --> 01:20.180
different types of
authentication here shortly.

01:20.210 --> 01:22.960
All right, identity.

01:22.990 --> 01:27.570
Identities that can help in identity
management, and identity provider.

01:27.600 --> 01:29.800
A lot of as a service stuff these days, is

01:29.830 --> 01:32.600
we're going to have a third
party actually do it for us.

01:32.630 --> 01:34.280
We're going to pay them to do it.

01:34.310 --> 01:36.780
An identity provider, a service that can

01:36.810 --> 01:40.120
store, manage, and verify digital
identities of an individual.

01:40.120 --> 01:42.360
That may be something
that's again a third party.

01:42.390 --> 01:44.600
It may be a product used internally, it

01:44.630 --> 01:47.720
may be active directory,
something along those lines.

01:47.750 --> 01:50.140
Attributes or any characteristics or

01:50.170 --> 01:53.850
features that define who the
user is or the type of user.

01:53.880 --> 01:57.800
A digital certificate, we talked about
those briefly in the first chapter.

01:57.800 --> 02:00.780
We're going to talk about those again
a little bit little bit later on.

02:00.810 --> 02:05.240
A digitally signed statement with a
public key and the subject name on it.

02:05.270 --> 02:09.140
Now, digital certificates are
used for a variety of purposes.

02:09.170 --> 02:11.100
The original purpose of a digital

02:11.130 --> 02:15.840
certificate was to bind the public
key to the identity of the owner.

02:15.870 --> 02:18.520
When we talk about authentication, we'll

02:18.550 --> 02:22.890
revisit when we talk about asymmetric
cryptography and how that might work.

02:22.920 --> 02:28.730
But a digital certificate is like
having your driver's license.

02:28.760 --> 02:33.360
It needs to be issued by an entity
that we've chosen to trust.

02:33.390 --> 02:34.860
Tokens.

02:34.880 --> 02:38.100
I have a secured system used to transfer
authentication information between two

02:38.130 --> 02:41.920
entities through a compact
and self contained approach.

02:41.920 --> 02:43.560
Got a couple of different
examples of tokens.

02:43.590 --> 02:46.660
We'll look at that as an
example of something I have.

02:46.690 --> 02:52.060
They could also be logical access tokens,
session identifiers, and that thing.

02:52.090 --> 02:54.420
Ssh keys for secure shell connections.

02:54.440 --> 02:57.720
A private and public key used to
authenticate a client to an SSH server.

02:57.750 --> 02:59.980
Believe me, we're going
to talk about that.

03:00.010 --> 03:03.100
Then smart cards are
little computers, really.

03:03.130 --> 03:05.160
They store the public key in a pin, acts

03:05.190 --> 03:07.820
as a secret key used to
authenticate the user.

03:07.850 --> 03:11.900
This is also an example of
something I have in my possession.

03:11.920 --> 03:13.480
If you're in the military, your cat card

03:13.510 --> 03:18.640
is one of the best examples on
planet Earth of a smart card.

03:19.000 --> 03:22.580
I guess my credit card is a pretty
good example of that though too.

03:22.610 --> 03:26.980
Anything with a gold contact
pattern qualifies as a smart card.

03:27.010 --> 03:31.220
But as far as access control
goes, cat cards in the military.

03:31.250 --> 03:32.860
User identity management.

03:32.890 --> 03:35.160
Identity management in general would be...

03:35.190 --> 03:38.200
Wait a minute, the
management of the identity?

03:38.230 --> 03:42.480
Yeah, so the creation, the management, the
deactivvation, the provisioning, the

03:42.510 --> 03:47.500
deactivvation are a method to ensure that
an individual holds a valid identity.

03:47.530 --> 03:51.300
Examples include attributes, username,
account number, and so forth,

03:51.320 --> 03:54.420
involves storing and managing user
attributes in their repositories.

03:54.440 --> 03:56.200
Probably the most widely used on planet

03:56.230 --> 04:00.540
Earth these days is active
directory on Windows servers.

04:00.570 --> 04:04.520
The Identity Repository, the database
where the attributes related users'

04:04.550 --> 04:09.080
identities are stored, and again, a N TDSD
IT file or Windows Active Directory

04:09.110 --> 04:12.200
database, probably one
of your best examples.

04:12.760 --> 04:18.520
User Access Management or AM for short
process of identifying, monitoring, and

04:18.540 --> 04:23.940
regulating authorized users access to
an IT system application resource.

04:23.970 --> 04:30.660
It is definitely a good idea to track
who does what and track it meticulously.

04:30.680 --> 04:32.440
That way you can investigate security

04:32.470 --> 04:34.860
violations, performance
issues and so forth.

04:34.880 --> 04:36.860
But that's one of the coolest things about

04:36.890 --> 04:41.700
digital access is we can record everything
you request and everything you do.

04:41.720 --> 04:43.680
It includes all the policies and processes

04:43.710 --> 04:47.540
and tools required for maintenance of the
AM with the IT infrastructure,

04:47.570 --> 04:52.000
creates and controls users, roles, groups
and policies, and monitors and ensures all

04:52.030 --> 04:54.280
the defined roles and
policies are followed.

04:54.280 --> 04:55.560
Fantastic.

04:58.640 --> 04:59.860
Examples.

04:59.890 --> 05:02.200
You use your authentication.

05:02.200 --> 05:03.880
Authentication, and I've mentioned this

05:03.910 --> 05:07.880
before, we're going to mention it again,
involves validating the identity of an

05:07.910 --> 05:11.860
individual with a system,
application, or network.

05:11.880 --> 05:12.800
So, halt.
Who goes here?

05:12.800 --> 05:13.620
I am Eric.

05:13.640 --> 05:15.340
Well, anybody can say they're
Eric. Authenticate, Eric.

05:15.360 --> 05:17.000
Authenticate Eric, prove it.

05:17.000 --> 05:19.540
Something I know is something
I have, something I am.

05:19.560 --> 05:21.060
We're going to talk about
that here in just a second.

05:21.090 --> 05:23.920
So a password, for example.
Something I know.

05:23.950 --> 05:25.460
All right, good enough.

05:25.480 --> 05:26.940
That's Eric's secret password.

05:26.970 --> 05:29.660
But also one of the weakest forms of

05:29.690 --> 05:35.460
authentication. All
right, so the factors of authentication.

05:35.480 --> 05:39.300
Something I know or type 1, also
known as a knowledge factor.

05:39.330 --> 05:44.440
A PIN password and your
username actually is a factor.

05:44.440 --> 05:45.800
Username, whoever knows I'm Eric.

05:45.800 --> 05:47.680
Yeah, but your username
should also be secret.

05:47.680 --> 05:49.620
It shouldn't be your email address, which

05:49.650 --> 05:54.140
everybody uses because it's globally
unique and it's never in use.

05:54.170 --> 05:57.680
But your username should be as secretive

05:57.710 --> 06:01.820
as your password, which in
more cases than not, it's not.

06:01.850 --> 06:04.480
But that means now the attacker has to get

06:04.480 --> 06:06.740
your password, they're going to figure
out what your username is as well.

06:06.770 --> 06:08.480
So two factors.

06:08.520 --> 06:09.820
Something you have

06:09.850 --> 06:14.900
also known as owner factor or hard tokens,
something you have in your possession,

06:14.920 --> 06:20.560
employee ID cards, hardware
tokens, USB drives with keys, etc.

06:20.590 --> 06:25.420
Cell phone for SMS second
factor authentication.

06:25.450 --> 06:27.820
Then something I am, that is biometrics,

06:27.850 --> 06:33.300
measurement of a physical characteristic
or measurement of an activity.

06:33.330 --> 06:37.680
For example, gait analysis
or signature dynamics.

06:38.400 --> 06:40.740
Those are the three factors.

06:40.770 --> 06:43.100
A combination of one or more is called

06:43.130 --> 06:46.780
strong authentication
or multifactor authentication.

06:46.800 --> 06:50.000
Attributes can be additional conditions

06:50.030 --> 06:54.440
that can
be factored in, no pun intended, that can

06:54.470 --> 06:57.780
be taken into consideration for
your access attempt as well.

06:57.800 --> 06:59.380
Somewhere that you are,

06:59.410 --> 07:04.620
something that you do, something
you exhibit, or someone you know.

07:04.650 --> 07:10.660
Somewhere you are, location based
authentication, users physical location.

07:10.690 --> 07:13.900
That could be based on IP
address or even GPS coordinates.

07:13.920 --> 07:17.820
Something you do, also known
as behavioral characteristics.

07:17.850 --> 07:22.400
Authentication based on actions
such as gesture or touch inputs.

07:22.480 --> 07:27.520
That swipe to that pin pattern that you do
on your phone where you have to connect

07:27.540 --> 07:31.260
the dots, that might be an example
of something you do as well.

07:31.290 --> 07:33.820
Something you exhibit, behavioral based,

07:33.850 --> 07:37.040
authentication, exhibiting
some device or thing.

07:37.680 --> 07:40.200
Then someone you know could be reliant on

07:40.230 --> 07:43.680
a web of trust models, so somebody
can validate or vouch for you.

07:43.710 --> 07:47.860
Can't give you a really good example of
that, but peer based trust models,

07:47.890 --> 07:51.440
one of your best examples of
that historically was PGP.

07:53.560 --> 07:57.500
Types of authentication,
password authentication.

07:57.530 --> 08:01.280
Flimsy as foreign we have,
but most widely used.

08:01.280 --> 08:03.160
Password authentication uses a combination

08:03.190 --> 08:09.200
of a username and a password to
authenticate users to the network.

08:09.200 --> 08:11.500
There we go.
Maybe a little out of order.

08:11.520 --> 08:13.260
Password is checked against database.

08:13.290 --> 08:15.240
Do we know what the password is?

08:15.270 --> 08:16.300
Usually not.

08:16.330 --> 08:18.280
It's the database that contains the

08:18.300 --> 08:24.040
password hash, which is an encrypted
version of the password, but the password

08:24.070 --> 08:27.180
we type in gets transformed
into a hash for matching.

08:27.210 --> 08:32.000
When we talked about the birthday attack
earlier, if I type in something that just

08:32.030 --> 08:36.280
happens to produce the same hash,
the system authenticates me.

08:36.310 --> 08:38.080
Kind of scary but true.

08:38.120 --> 08:40.760
Password authentication can be
vulnerable to password cracking attacks.

08:40.790 --> 08:44.160
We've already talked about some
examples of password cracking.

08:46.080 --> 08:47.740
Two factor authentication.

08:47.770 --> 08:50.620
Anything that involves
more than one factor.

08:50.650 --> 08:55.140
Typically, something I have, something
I know, something I am, etc.

08:55.170 --> 09:01.160
We know that something you are
is one of the best companions of two

09:01.170 --> 09:05.020
factor authentication since it's the
measurement of a physical characteristic.

09:05.040 --> 09:06.600
Something in my possession could be stolen

09:06.600 --> 09:10.000
and somebody could guess my password, but
somebody is probably not likely to steal

09:10.030 --> 09:13.340
my thumb for fingerprint
based authentication.

09:13.360 --> 09:15.160
Of course, we've seen all the movies where

09:15.190 --> 09:17.900
they chop off the guy's
thumb and replay it.

09:17.930 --> 09:23.200
But there are ways to attack this, jelly
fingers and imprints and so forth, but

09:23.230 --> 09:27.380
generally speaking, it's much tougher
to steal a physical attribute.

09:27.410 --> 09:30.780
Couple of examples of two
factor authentication.

09:30.800 --> 09:31.620
Tokens.

09:31.650 --> 09:35.580
Remember these guys, the
old RSA secure ID tokens.

09:35.610 --> 09:38.500
Hardware tokens, a dongle,

09:38.530 --> 09:44.020
key fob, built in token authentication
factor, rotated every 30 seconds.

09:44.040 --> 09:46.720
Software tokens are installed
on your phone, for example.

09:46.750 --> 09:52.440
They may have a time sequence based
counter or challenge input, which we're

09:52.470 --> 09:57.100
going to differentiate between
those here in just a second.

09:57.130 --> 09:59.820
Two factor authentication techniques.

09:59.850 --> 10:07.680
Open authentication uses a couple of
different flavors of sequential increment

10:07.700 --> 10:12.020
encounters or time based authentication,
but it's based on...

10:12.040 --> 10:13.760
The main goal is to provide safe and

10:13.790 --> 10:17.580
secure online transactions for users
based on two factor authentication.

10:17.610 --> 10:20.400
It's introduced three algorithms which are

10:20.430 --> 10:26.060
HOTP, HMAC based one time password, O CRA,
which I can never remember the acronym

10:26.080 --> 10:33.300
for, OAuth challenge response
mechanism, and then time based or TOTP.

10:33.320 --> 10:39.760
In a nutshell, you've got a secret
component, you've got a variable, and you

10:39.790 --> 10:43.220
got an algorithm, and then that
produces the one time password.

10:43.250 --> 10:46.280
This moving factor is your variable, this

10:46.280 --> 10:48.800
is a constant, and then the
algorithm is a constant.

10:48.820 --> 10:51.920
In a HMAC based one time password, you

10:51.940 --> 10:57.060
might have a counter, for example,
that increments by one.

10:57.080 --> 11:00.640
It's only used once, the next time it
increments, you generate and so forth, and

11:00.670 --> 11:02.980
you got a sequentially
incrementing counter.

11:03.010 --> 11:09.060
In O CRA, you have a challenge versus
a sequentially incrementing counter.

11:09.080 --> 11:13.520
The moving factor is it could be a
counter, but it's entered as a challenge.

11:13.550 --> 11:18.340
And at a time based one time password,
the moving factor is the time of day.

11:18.370 --> 11:22.820
So the clock synchronization of the
device and the server is important.

11:22.840 --> 11:24.440
And sometimes those things would fall out

11:24.470 --> 11:28.880
of sequence and it would go forward 30
seconds or backward 30 seconds and check a

11:28.910 --> 11:34.440
couple of time skews just to
see if it got out of alignment.

11:34.920 --> 11:37.400
Biometric authentication, fingerprint

11:37.430 --> 11:40.780
scanning, iris, retinal
vein structure and more.

11:40.810 --> 11:44.540
Most are familiar with
fingerprint based scanning.

11:44.570 --> 11:48.220
Most mobile devices these days have
fingerprint based recognition.

11:48.250 --> 11:50.320
The iris scanning is the colored portion

11:50.350 --> 11:53.940
of your eye, which is
very reliable, very accurate.

11:53.970 --> 11:59.220
Retinal scanning analyzes the layer of
blood vessels on the back of your eye.

11:59.250 --> 12:02.040
That actually can be subject to errors

12:02.070 --> 12:07.060
based on pregnancy or diabetes, which both
have an impact on your blood pressure,

12:07.080 --> 12:09.740
which can actually alter
your blood vessels.

12:09.770 --> 12:12.560
Vain structure recognition, thickness and

12:12.580 --> 12:16.040
location of veins, bone
density scanners, etc.

12:16.070 --> 12:19.220
Lots of different physical characteristics

12:19.250 --> 12:23.160
that can be examined for
biometric authentication.

12:23.440 --> 12:26.320
Our face recognition, voice
recognition, gait analysis.

12:26.350 --> 12:28.640
I haven't seen this one firsthand here,

12:28.670 --> 12:33.200
but uses patterns of locomotion,
exhibit by moving limbs while walking or

12:33.230 --> 12:38.560
running, and your gait has
a unique signature to it.

12:39.040 --> 12:42.440
Some performance metrics
of biometric systems.

12:42.470 --> 12:48.500
We're not going to pick each one of these
apart, but the efficacy rates or the

12:48.530 --> 12:52.860
effectiveness are things like
reliability, throughput.

12:52.890 --> 12:58.280
Imagine you're clocking shift workers into
a factory using biometrics, the throughput

12:58.280 --> 13:01.460
rate is pretty important and you
also want it to be pretty accurate.

13:01.490 --> 13:06.440
So false acceptance
and false rejection rates are two

13:06.470 --> 13:10.220
different metrics that determine
the accuracy of the system.

13:10.250 --> 13:14.900
False acceptance is when you
are incorrectly authenticated.

13:14.930 --> 13:18.380
Fault alse rejection is where
you're incorrectly denied.

13:18.410 --> 13:23.100
So false acceptance
has definite security concerns.

13:23.130 --> 13:25.620
False rejection also does due to the fact

13:25.650 --> 13:28.300
that you've got basically
a denial service.

13:28.330 --> 13:30.460
The crossover error rates

13:30.490 --> 13:35.460
is the point at which the number of Type
1s, which are false acceptance,

13:35.480 --> 13:37.900
meet the number of Type 2s,
which are false rejections.

13:37.930 --> 13:42.440
The lower that CR value, the more
accurate the system is said to be.

13:42.470 --> 13:48.340
Matching speed, time taken off indicated
individual, failure to capture.

13:48.370 --> 13:51.920
When you enroll in a biometric system, you

13:51.950 --> 13:54.860
present the physical
characteristic multiple times.

13:54.880 --> 13:57.160
For example, thumbprint,
thumbprint, thumbprint, thumbprint.

13:57.160 --> 14:00.540
You get the little circle that's going
click, click, click, click, click.

14:00.570 --> 14:06.540
That enrollment process creates an
aggregation or averaging of those inputs

14:06.570 --> 14:12.380
to provide a user profile or template to
match subsequent login attempts against.

14:12.410 --> 14:14.560
The failure to capture, failure to enroll

14:14.580 --> 14:19.480
would be the number of failures
when initially adding...

14:19.480 --> 14:21.220
Initially adding, I guess, that works,

14:21.250 --> 14:24.640
when you initially add
a user to the system.

14:24.640 --> 14:26.320
Again, throughput is the rate at which we

14:26.350 --> 14:32.100
can authenticate, especially important
in physical access time, clock

14:32.130 --> 14:37.280
based authentication, factory
shift workers, that thing.

14:37.360 --> 14:38.860
Smart card authentication.

14:38.890 --> 14:41.240
Smart card is a small computer chip, holds

14:41.270 --> 14:44.420
the user's personal information
required to authenticate them.

14:44.440 --> 14:46.280
They need to insert their
smart cards into a reader.

14:46.310 --> 14:49.580
There's a PIN, which is a
something I know factor.

14:49.610 --> 14:54.460
The smart card then actually
verifies user's identity.

14:54.490 --> 14:57.380
It's a cryptography based authentication,

14:57.410 --> 15:02.540
provides stronger security than password
authentication, and it uses asymmetric

15:02.560 --> 15:05.340
keys, which we're going to talk about
a little bit later in the course.

15:05.370 --> 15:09.400
But in a nutshell, the public key is used

15:09.400 --> 15:12.380
to encrypt the challenge that is
decrypted by the private key.

15:12.400 --> 15:16.260
And we'll talk a little bit more about
things called like zero knowledge proof,

15:16.290 --> 15:19.660
which are different ways to
use asymmetric encryption.

15:19.690 --> 15:25.760
And we will definitely talk about digital
signatures and hybrid encryption.

15:25.800 --> 15:27.480
Single sign on authentication.

15:27.510 --> 15:32.940
The advantage to single sign on is I log
in once, I get access to everything.

15:32.970 --> 15:38.180
The disadvantage to single sign in is I
log on once, I get access to everything.

15:38.210 --> 15:42.400
It's very convenient,
but also the keys to the kingdom type of

15:42.430 --> 15:45.460
connot where that might
be considered dangerous.

15:45.490 --> 15:47.600
If I was to steal your single set of

15:47.600 --> 15:50.300
credentials, I have access to
everything you have access to.

15:50.330 --> 15:55.480
That raises some security concerns,
but the convenience factors one out here

15:55.510 --> 15:58.280
is we see a lot of single
sign on solutions.

15:58.310 --> 16:00.460
There's advantages and disadvantages.

16:00.490 --> 16:04.180
It can be implemented through
different technologies.

16:04.210 --> 16:07.980
We'll talk a little bit more about
those a little bit later in the course.

16:08.010 --> 16:10.740
User access management authorization.

16:10.770 --> 16:15.620
Okay, authorization is controlling the
access of information for the individual.

16:15.650 --> 16:21.740
Again, once I've identified, I am Eric,

16:21.770 --> 16:28.420
and authenticated, I've proved it, right?

16:28.450 --> 16:35.140
Now I try to access something and
it determines, am I authorized?

16:35.170 --> 16:38.560
If I'm not authorized, what do you mean?

16:38.560 --> 16:40.280
I'm Eric and I just proved my identity.

16:40.310 --> 16:42.740
Yeah, but you don't get
access to anything, Eric.

16:42.760 --> 16:43.500
Sorry.

16:43.530 --> 16:49.300
I verified your identity, but according to
this, you don't get access to anything.

16:49.330 --> 16:51.180
What's up with that?

16:51.210 --> 16:54.160
Or I'm authorized to
access specific resources.

16:54.190 --> 16:56.360
Again, we're just
identifying the user here.

16:56.390 --> 17:00.280
Whether I get access to resources is
completely at the discretion of the owner

17:00.310 --> 17:05.720
or through some mandatory rule
based or rule based access control.

17:05.880 --> 17:08.700
While we've got the whiteboard up, that

17:08.730 --> 17:15.140
also leads to accounting
and accountability.

17:15.170 --> 17:19.160
There's an auditing component
that's wrapped in there as well.

17:19.190 --> 17:21.560
You can see before or after, but auditing

17:21.590 --> 17:24.800
is recording my actions, which
gives me accountability.

17:24.830 --> 17:28.760
And auditing and accounting are
sometimes used interchangeably.

17:28.960 --> 17:31.960
All right, types of authorization systems.

17:31.990 --> 17:37.440
If it's centralized, I am maintaining a
single database for authorizing the

17:37.470 --> 17:41.570
networks, a resource for
applications, easy and inexpensive.

17:41.600 --> 17:44.880
If it's decentralized, each network

17:44.910 --> 17:49.500
resource maintains its authorization
unit and performs authorization locally.

17:49.530 --> 17:53.400
So in a decentralized model, it might
be a work group or peer to peer model.

17:53.430 --> 17:55.620
In a centralized model, it might be a

17:55.650 --> 17:59.860
domain or client server model if
you're talking Microsoft Lingo.

17:59.890 --> 18:01.040
Implicit or explicit.

18:01.070 --> 18:07.940
The implicit is implied, explicit
is explicitly assigned.

18:07.970 --> 18:16.140
Unless I explicitly authorize
your implicit permissions apply.

18:16.170 --> 18:18.320
Typically, and this is a twofold

18:18.350 --> 18:23.520
discussion, your implicit permission
is something that's not configured.

18:23.550 --> 18:25.560
It's a given, it's assumed.

18:25.590 --> 18:28.940
You should always have an
implicit deny on everything.

18:28.970 --> 18:31.120
Unless stated otherwise, you are not

18:31.150 --> 18:34.920
allowed to access to anything
unless I explicitly allow it.

18:34.950 --> 18:37.140
Best case security scenario.

18:37.170 --> 18:42.080
If you have an implicit allow and explicit
deny, we'll call that blacklisting.

18:42.110 --> 18:45.700
If you have an implicit deny and

18:45.720 --> 18:48.380
explicit allow, I'll think about that for
a second, we'll call that whitelisting.

18:48.410 --> 18:53.160
We'll see a couple of different
configurations or context for this.

18:53.190 --> 18:55.900
But in the implicit authorization, users

18:55.930 --> 18:58.620
can access the requested
resource on behalf of others.

18:58.640 --> 19:01.960
The request to access goes to a primary
resource to access the requested resource.

19:01.990 --> 19:05.600
In explicit, each authorization requires a

19:05.600 --> 19:07.920
separate authorization for
each requested resource.

19:07.950 --> 19:11.460
An explicit maintains the authorization
for each requested object.

19:11.490 --> 19:14.180
You see implicit explicit used in

19:14.210 --> 19:19.140
different contexts three or four
different ways by the time the courses...

19:19.170 --> 19:20.760
By the end of the course.

19:20.790 --> 19:23.960
Here we go.
Accounting.

19:23.990 --> 19:28.050
Accounting is a method of keeping
track of user actions on the network.

19:28.080 --> 19:31.530
It's also auditing, keeps track of who,
when, and how the users access the

19:31.560 --> 19:35.320
network, helps in identifying
authorized and unauthorized actions.

19:35.320 --> 19:37.040
It can be used for trend analysis, data

19:37.070 --> 19:39.530
breach detection, forensic
investigations, etc.

19:39.560 --> 19:41.720
That is logging.

19:41.800 --> 19:43.560
Your account types.

19:43.590 --> 19:46.240
Account types are privileged or

19:46.270 --> 19:51.250
nonprivileged or a guest account, which is
even less privileged than a nonprivileged.

19:51.280 --> 19:56.380
But a user account
runs with least privileges permissions,

19:56.400 --> 19:59.000
running applications, programs,
creating and manipulating files.

19:59.030 --> 20:01.570
Your average user is a user account.

20:01.600 --> 20:04.120
Guest accounts have even less privilege,

20:04.120 --> 20:07.420
don't have any privileges to modify
system files, directories or settings.

20:07.450 --> 20:10.380
They more or less have Internet
access, not much more.

20:10.410 --> 20:16.840
A service account is configured
specifically for services to authenticate.

20:16.870 --> 20:19.520
You still want to implement granularity of

20:19.550 --> 20:24.180
access control, principle of least
privilege, but these are used to give

20:24.210 --> 20:27.290
applications their privilege
or context to run.

20:27.320 --> 20:31.530
It has administrative privileges
based on the application requirement.

20:31.560 --> 20:35.320
Administrator root accounts have
elevated privilege on the system.

20:35.350 --> 20:41.920
These typically have global system access,
perform high system level functions,

20:41.950 --> 20:47.810
install and uninstall applications,
software, sign user permissions, etc.

20:47.840 --> 20:49.940
Then privilege accounts have

20:49.970 --> 20:54.200
administrative control over one or several
systems, permitted access to any resources

20:54.200 --> 20:57.400
in the system, configured drivers, add to
scrubbed applications, which a lot of

20:57.430 --> 21:00.570
times those are wrapped into
administrator root accounts.

21:00.600 --> 21:04.600
But typically that admin or root account
is the high level account in the system.

21:04.630 --> 21:06.840
Other privilege accounts may be entities

21:06.870 --> 21:12.480
created with elevated permissions or throw
them in like the administrators group.

21:14.080 --> 21:16.940
Shared or Generic Accounts.

21:16.960 --> 21:18.720
It's generally not recommended that you

21:18.750 --> 21:22.660
share accounts for anything because
you have no accountability for it.

21:22.690 --> 21:26.200
But a shared generic credentials
are shared amongst multiple users.

21:26.230 --> 21:28.720
Typically used when the network is divided

21:28.750 --> 21:32.140
needs individual centralized
units for network management.

21:32.170 --> 21:36.640
Application accounts we just talked about.

21:37.640 --> 21:39.160
Service accounts, application accounts,

21:39.190 --> 21:42.760
pretty
much the same idea used by applications,

21:42.790 --> 21:45.090
interactive database,
execute match scripts.

21:45.120 --> 21:47.500
Group based accounts created

21:47.520 --> 21:50.520
to simplify the process of allocating
access rights to individual users.

21:50.550 --> 21:53.900
The advantage to group based access

21:53.930 --> 21:59.000
is that you provide the permissions to the
group, you configure access control list

21:59.000 --> 22:01.240
one time, and then you just
put users in the group.

22:01.270 --> 22:02.000
There you go.

22:02.030 --> 22:05.360
Throw them in the group, they
automatically get permissions.

22:06.120 --> 22:08.280
Then third party accounts are used by

22:08.280 --> 22:11.360
enterprises to handle cloud applications
or other third party services.

22:11.360 --> 22:13.240
Typically set up with a cryptographic key

22:13.270 --> 22:18.620
or password based authentication,
use Host through APIs or SSH.

22:18.650 --> 22:21.290
Now, again, there are other

22:21.320 --> 22:24.360
variations of that, but those are
our classic types of accounts.

22:24.390 --> 22:28.220
That is going to wrap up
our module for Module 4.

22:28.250 --> 22:30.360
Up next, Module 5.

22:30.360 --> 22:32.000
See you back here in a few minutes.