Original subtitles

In our next section we will talk about password policies elements and passwords.

Elton Matthews

so most systems in an enterprise network use some form of authentication to grant or deny user access

when users access a system a user name and password are usually invoked as you know at the most of the

time it is like that and it might be fairly easy to guess someone's user name based on that person's

real name.

If the user's password is set to some default value or to a word or text text string that is easy to

guess an attacker might easily gain access to the system too.

So guys think like an attacker for a moment and see if you can make some guesses about passwords you

might try if you want to log in to a random system.

Perhaps you told totes of passports like Password password 1 3 1 2 3 4 5 6 and so on right.

And perhaps you could try a username as admin and password like admin an attacker can launch an online

attack by actually entering each password.

Yes as the system prompts for user credentials.

In contrast to an offline attack occured when the attacker is able to retrieve the encrypted or hashed

passwords ahead of time then goes off line to an external computer and uses software there to repeatedly

attempt to recover the actual password.

So attackers can also use software to perform dictionary attacks to discover a user's password.

The software will automatically attempt to log in with passwords taking from a dictionary or worthless.

In this meta guys and it's might be a I'm sorry it's mine I have to go through thousands or millions

of attempts before discovering the real password.

In addition the software can perform a brute force attack by trying every possible combination of letter

number and symbols strings and brute force brute force attacks Rick are really very power powerful computing

resources and a large amount of time and to mitigate password attacks an enterprise should implement

a password policies for all users guys.

Such a policy might include guidelines that require a long password string made up of a combination

of upper and lower case characters along with numbers and some special characters.

Maybe the goal is to require all passwords to be complex strings that are difficult to guess or reveal

by a password attack as well.

Password management should require all passwords to be changed periodically so that even length the

brute force attacks would not be able to recover a password before it is changed again.

And yes.

Passports have some vulnerabilities sometimes and for critical systems enterprises mostly consider to

use passwords alternatives and they are multi factor authentication physical access control certificates

and their biometrics.

And let's take a look to these alternatives and learn about them.

As simple passwords passwords string in the single factor that a user must enter to be authenticated

because a password should be remembered and not written down to anywhere you might think of your password

as something you know hopefully nobody else knows this too.

Otherwise they could use it to impersonate when you authenticating right multi factor authentication.

Which is also known as MFA is an authentication method in which a computer user is granted access only

after successfully persisting two or more pieces or of evidence or factors to an authentication mechanism.

No Lich and something the user and only the user knows that means and possession something the user

and the only the user has and inherits something the user and the only the user s and two factor authentication

for example also known as to FAA is at type or subset of multi factor authentication.

It is a method of confirming users claimed identities by using a combination of two different factors

one something they know 2 something they have or 3 something they are a good example of two factor authentication

is the throwing of money for and 18 for example.

All of us do this right.

Then only the correct combination of a bank card and PIN number allows the transaction to be carried

out.

Two other examples are supplement a user controlled password with a one time password to a OTP or code

generated or received by an authenticator.

For example like it may be a security token or a smartphone that only the user possesses let's go ahead

with the digital certificates at digital certificate can serve as one alternative factor because it

serves as a trusted form of identification and adherence to a standardized format and contains encrypted

information guys.

If an enterprise support certificate to use then a user must request and be granted a unique certificate

to use for specific purposes for example certificates used for authenticating users must be approved

for authentication in order to be trusted.

Certificates must be granted to and digitally signed by a trusted certificate authority known as S.A..

As long as these services used by these sent enterprise gnome and the trust to see a then individual

certificate signed by that S.A. can be trusted as well.

Biometric credentials are another password alternative can be used and biometric credentials carry this

scheme even further by providing a factor that represents something you are.

The idea is to use some physical attribute from a user's body to uniquely identify that person physical

attributes are usually unique to each individual's body structure and cannot be easily stolen or duplicate

that right and for example a user's fingerprint can be scanned and used as an authentication factor.

Other examples include face recognition palm prints and voice recognition iris recognition and retinal

scans.

As you might expect some methods can be trusted more than others and sometimes facial recognition systems

can be fooled when presented with photographs or masks of trusted individuals.

Injuries and the aging process can also alter biometric patterns such as fingerprints facial shapes

and iris patterns to help mitigate potential weaknesses.

Multiple biometric credentials can be collected and used to authenticate so users as well.