Original subtitles

Welcome to the lecture on IAM, which stands for Identity and Access Management.

So we you have divided IAM into two parts.

We are going to start with the first part.

Now, cybersecurity contains a lot of acronyms, and IAAA is one of them.

So I stands for identification now, this basically refers to just identifying an entity, so, for example,

if you enter a bank and if the cashier asks you for identity and you say, I'm John, this just means

that you have identified yourself, you have just provided your name, or if you're working on a system

you have just provided your username. It is important to understand that identification is different

from authentication. Now authentication is when you actually verify your identity.

But identification can be done independent of authentication.

You could claim any identity you want, it doesn't mean that you can actually, you know, validate it later

on.

But Identification just means claiming an identity.

So after identification we have authentication, which basically means that you prove who you claim

to be.

And this can be done through several mechanisms.

For example, you can provide a secret password, your secret pin, or it could be some sort of biometric

data, for example, your fingerprints or retina scans.

Please keep in mind that authentication can only be done once you have identified yourself because authentication

is done against an identity, i.e., your claimed identity.

So only after you have provided your identity can you authenticate.

Authentication is important because it provides non repudiation.

It is an important term in cybersecurity.

What it means is that you cannot claim that it was not you who performed some actions on a system so

Non

repudiation basically means that you are bound by what you do.

So, for example, if you provide your identity and you authenticate it by providing a password and then

you do certain tasks on a system, then you are responsible for that.

You cannot later on claim that it was someone else.

So this is the concept of non repudiation.

We know exactly who did this task.

After authentication, we have authorization. Now once you are authenticated, it means that you

are a legitimate user, you're allowed access to different parts of the system.

But not all users have equal privileges.

There are some users who have higher or elevated privileges.

For example, a CEO of a company would obviously have elevated privileges compared to a normal employee.

Similarly, a network administrator may have more extensive or more extended access on different parts

of the systems on databases, for instance, compared to a normal user.

Now, this is done through authorization, which basically means that it specifies your level of clearance.

What kind of data, what kind of systems, what kind of applications do you have access to?

This is enforced through access control lists, which define which user has which type of access.

Now, this can be very broad based.

You can have big groups.

For example, you have a group of admins, you have a group of normal employees, you have a group of

accountants, and they have the same privileges.

Or you could also have a system in you in which you use more fine tuned details and you drill down and

you can even go up to file level access.

As you can say, for example, this user can access this file in read-only mode so on.

Now always remember, authorization can only be done or consulted once a user has been authenticated

because authorization is always against an authenticated user.

So the last step after authorisation is accountability, which basically means holding users responsible

for their actions.

So even though you are a legitimate user of a system and you already have predefined authorization,

but still it is nice to double check if any user has performed an activity he was not allowed to.

And this is not always malicious.

Sometimes inadvertently, users are assigned privileges that they were not meant to have.

So, for example, this often happens when, you know, you change roles within an organization or when

you acquire, you know, more privileges over time.

And so basically we need some sort of an audit mechanism to ensure that privileges are appropriately

assigned and updated.

And that tool is accountability.

Now, accountability is done by doing account audit and log reviews.

Let's see how it pans out in real life, so here's Jim.

Jim goes to a bank and at the counter he says, Hi, I'm Jim.

Now, at this point, Jim has only identified himself, so identification is complete, but we haven't

talked anything about authentication. So the officer at the counter, the bank officer.

He says, ID please.

Now, Jim produces his driver's license and the officer verifies it and says, thank you.

Now, at this point, Jim has authenticated himself to the system.

So the difference between identification and authentication is that ID just means claiming something,

whereas authentication means verifying it and verification can be done in a number of ways.

It could be your driver's license.

It could be a PIN number.

It could be a password and so on.

So next, Jim says, can I withdraw ten thousand dollars?

And the bank officer says you're only allowed five thousand dollars per day.

Now, this is what we call authorisation. Now, even though Jim has identified himself and he is authenticated,

but authorization deals with what functions or what things Jim has access to.

So this is where the authorization comes into play, it creates the checks and balances and makes sure

that Jim can only perform operations he's authorized to.

And finally, we may have an audit officer who periodically checks bank records to detect inconsistencies

and to make sure that all bank operations were properly authorized.

Now, this completes the accountability part, let's discuss identification and authentication in more

detail.

So identification is when a subject claims an identity.

So, for example, claims such as I'm John Cooper are showing your ID badge or facing a camera for retina

or face scan are all examples of identification. At this point.

you are not authenticated.

You are just claiming an identity.

Authentication refers to proving the identity of the subject.

And this proof is done by providing a password or a PIN number, for example, or biometric data.

Let's have a look at the different phases in an identity lifecycle which helps organizations streamline

their identity and access management process.

So the first step is provisioning.

In this step, we create new accounts and we assign privileges to those accounts.

But we also have a review process which requires periodic account reviews.

Now, this helps highlight several serious problems sometimes.

So, for example, we may detect accounts which are no longer active, which should be disabled, but

it also helps us identify privilege creep.

So privilege creep happens when a person moves vertically up in an organisation and over time he or she may accumulate

excessive privileges.

So let's say a person joins the H.R. department and later on they join the network department and they

become the network administrator, but they still retain the privileges from their HR account.

Now, this is referred to as privilege creep, and this can only be highlighted if you do periodic account

reviews and audits.

And the last step is revocation.

This refers to disabling accounts of employees who leave, retire or are terminated.

Now, this is different from disabling inactive accounts.

And revocation is a very important step from a cybersecurity perspective, because especially if you

have an employee who has been terminated and if he still has access to his account, he may leverage

that access to launch attacks on the company, for example, or cause any other type of damage.

So it is always a nice idea to quickly revoke access to accounts of users who leave, retire or terminated.

We have different categories of authentication factors and we're going to go from the weakest to the

strongest ones.

So the first type is type one, this is something that, you know, for example, you know, your password

or, you know your secret pin. It is an authentication factor,

but it is not a great one because people sometimes do lose their passwords and pins to other people.

They may note it down somewhere, or it may get hacked and so on.

So the next category, which is slightly stronger, is something that you have, for example, if

you possess a smart card or a mobile SIM and you receive a message on that SIM, for example.

Now, this is something that you have. The strongest type of authentication factor is type three, which

is something that you are.

So your retina pattern, fingerprints, so these are some things which cannot really be stolen.

Nobody's going to steal your retina, for example.

So as we move from type one to type three, we move from the weakest authentication factors to strongest

ones.

Let's start with the Type 1 authentication factor, which is something you know, and a typical example

of this is the password.

There are some safety tips which must be observed if you are using this type of an authentication factor.

So let's have some tips on password, for example, to your password.

Should at least be eight characters long.

If it's very short, it would be easily broken.

It should always contain both uppercase and lowercase alphabets.

It should also contain at least one numeric character.

So the reason we are increasing the length of your password and including uppercase and lowercase alphabet

and numerics is we want to increase the number of possibilities so that it becomes exponentially difficult

to break it through brute force, for example.

It should contain at least one special character.

It's always better to have passphrases which are easier to remember, but difficult to break.

So, for example, I like Superman.

This is a phrase easier to remember and much harder to break because it has a longer length compared

to a typical password. Even if you write a normal sentence,

it is very hard to break that because the sheer length of that password makes it exponentially difficult

to break it.

You should never use common names, for example, cities, or use common patterns like 1 2,

3, ABC. and so on.

But always remember, you should never enforce an I.T. policy which forces users to select extremely

complex passwords.

So, for example, if you ask your users to have passwords which are at least 12 characters and which

contain uppercase, lowercase, numeric and special characters and so on, then they are definitely

going to have to create a password, which is difficult and complex.

And in order not to forget it, they are very likely to write it down on a Post-it and stick it under

the desk.

So this is just common sense.

We always need to balance security compared with complexity.

We don't want to make a solution which is so complex to implement.

Next is type two, this is something that you have so this refers to something which you physically

possess, it could be your identity badge, a smart card, your mobile sim on which you receive messages,

or it could even be an application.

So, for example, you can install Google authenticator.

So the contrast from Type-I is that in Type-I, it was something that you knew, something stored

in your brain.

Now, this is something which you have to physically possess.

The last type is Type-III, which is something that you ARE. Now, this refers to biometrics.

So basically, we have different type of biometrics, so the first is retinal scan, which is top of

the list, it is the most accurate and it can even successfully differentiate between identical twins.

Next is Iris scan, which seems similar, but it's quite different from retinal scan.

So iris scans is slightly less accurate compared to retinal scan.

However, there is a cost associated with retina scans because in retina scans, you have to put your

eye really close to the scanner and then a beam of light enters your eye.

This makes the whole process quite uncomfortable for a lot of users.

In contrast, Iris scan can be done from a few feet away and it is not at all uncomfortable.

So there's always this human tradeoff between these two. Next are finger prints.

So if you're scanning 4 or more fingers, then your results would be pretty accurate around ninety

nine point nine percent accurate.

Next are palm scans. Now this previously referred to the geography of your palm, but modern palm

scanners, they basically capture millions of data points of your palm veins and they can produce amazingly

accurate results.

The last one is your voice pattern. It is traditionally regarded not as accurate as other type of biometric

scans, such as retinal scans.

There's another factor which you need to consider.

Some of these biometrics are constant throughout your life and some of them change over age.

So, for example, your voice changes over age, your fingerprints.

If you get really old, they may start to fade.

But your retina scan, for example, is something which never really changes throughout your life until

and unless, you know, if you have any medical problem which can obviously affect any of these biometrics.

A great tool in the arsenal of cybersecurity specialists is multifactor authentication.

So the problem stems from the fact that, you know, if you're just using a password, you know, you

give your username and password to log into a system.

So this is single factor authentication because you're just using the password and this provides very

weak security.

Only your password needs to be compromised in order for the system to be breached.

So this can be alleviated if you use multifactor authentication, which combines more than one type

of authentication.

So often we combine Type-I and Type-II.

So Type-I was something that, you know, for example, your password and Type-II is something that

you have.

So, for example, you have your mobile SIM card and then you can receive an SMS.

So the way this works is that let's say you're logging into a system, you provide your username and

password, but after providing your password, if your password is authenticated, the system is going

to generate an SMS and send it to your mobile phone.

Now, your SIM is something that you have and then you need to put in the confirmation code that you

receive in your SMS.

So this provides for two factors and hence the name multifactor authentication.

When we combine two factors, it's called 2FA.

And when we combine three factors, it's called 3FA.

Let's have a quick question to see if you understand authentication factors, so in this example, is

it a single factor authentication or multifactor authentication?

I'll let you think about it for a few seconds.

And secondly, which type of authentication factors are being used? is it Type-I, Type-II, Type-III,

which one's?

So the answer to the first question is that, yes, this is multifactor authentication, because two

different factors are being used and the person is using both Type-I and Type-II factors.

So Type-I is something, you know, so the person is, you know, punching in his pin number.

So this is something he knows.

And second is the card which he plugged in.

So this is Type-II, which is something that you have. So, whenever you see any authentication system,

you can try to, you know, dissect it and analyze it and try to determine which type of authentication

factors is the system using.