Cyberspace and Cybersecurity: Archive Post 3

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic - Network Security Best Practices
Discuss the best practices for securing wired and/or wireless networks.
From February 24, 2012.

The best practice in securing a wired network is to properly identify and authenticate users, and the way to do so properly is through multi factor authentication. The traditional factor used for authenticating users in most networks is through the use of a password or passcode, this is an instance of something that the user knows. Other factors that can be used is something that the user is, that is a biometric feature like retinal image or fingerprint, or something that the user has, like a magnetic card or even a physical key. "Authentication methods that depend on more than one factor are more difficult to compromise than single-factor methods. Accordingly, properly designed and implemented multi factor authentication methods are more reliable and stronger fraud deterrents" (Wihenly, 2005, pg 3).

At present, a common and cost-effective method of implementing two factor authentication remotely is through a combination of password and a "hardware token-generated random PIN" (Vacca, 2009, pg 139) which demonstrates possession of the token generating hardware.

The hardware token PINs are used alongside the username and password combination to log into a secure system or VPN, with the user submitting the PIN that is shown on their token at the time of login. The appropriate PIN for the username is generated by the server and compared to the submission to confirm that the user possesses the required token. (RSA, 2010)

This method of two factor authentication is only effective as long as the seed information to each token is kept secret. If an attacker is able to steal the seed information, they can generate the appropriate PIN the same way that the server does. An example of this was demonstrated when the spoils of an intrusion against RSA was used to compromise Lockheed Martin. (Drew & Markoff, 2011)

---

Wihenly, (2005). Authentication in an Internet Banking Environment. Retrieved from http://www.ffiec.gov/pdf/authentication_guidance.pdf

Vacca, J. R. (2009). Computer and information security handbook. Burlington, MA: Morgan Kaufmann.

RSA. (2010). RSA SecureID Two-factor Authentication. Retrieved from https://www.rsa.com/products/securid/sb/10695_SIDTFA_SB_0210.pdf

Drew, C. & Markoff, J. (2011) Data Breach at Security Firm Linked to Attack on Lockheed. Retrieved from https://www.nytimes.com/2011/05/28/business/28hack.html?_r=1