March 2022ENTERPRISE SECURITY| | 9attacker tries to guess the password using large lists of passwords against any given username) as the username & password alone won't be enough if the attacker doesn't have the additional token information. This also prevents leaked credentials, such as those where a user gets a phishing email which requests the user to change their password. They click on a link to supposedly change the password by entering the existing username & password, then they get an error saying it was unsuccessful and to try again later. Well, unfortunately they just gave their credentials to an attacker. Said attacker than uses those credentials for their own nefarious purpose(s). And another attack that MFA defends against is a password reuse attack. This would be when a user reuses their password across multiple services. If one service gets breached and the password obtained, an attacker could get the password from company or service A and then use the same password log into company or service B. All of these won't be successful logins if the attacker doesn't have the additional token. Additionally, to authenticate a user, there are other options outside of credentials. Getting rid of credentials all together, using things like a Yubikey (example, not only company doing this) or hardware authentication. These support multiple authentication protocols and can be a token or ones which require the hardware plus requiring fingerprint or biometric additionally. This takes authentication away from the end user. Reduces the chances of the above attacks and it reduces password reset requests. A smoother end user experience as well. Stronger security and better workflows. Still, there are other options too, such as password less logins with things like Windows Hello. This type of login would be hardware supported secure way to access a Windows 10 device using a few options: a pin, a camera for facial recognition, and even a fingerprint. These would be verify difficult for a remote attacker to obtain and use against an system to gain unauthorized access. Nothing is perfect, yet proper identification starts with stronger methods to authenticate the user and prove the identity of said user. Second Part - Access Rights:Once the user has been identified, through authentication, the next thing to do is know what a user is allowed to do. Not everyone does the same thing and we shouldn't all have access to the same things. Thus comes in role based access controls (RBAC) and adopting principles of access like PoLP or principle of least privilege. Looking at the role a user is fulfilling, an organization can assign rights to a role. Then assign a user to that role. This allows scale better than assigning individual rights to each and every user. This allows us to assign role-based access and do it efficiently. The second aspect is only assigning the rights or permissions that a person would need to do their job. So least privilege is accomplished by only giving access to rights one needs to perform their function. Such as, only those in HR gets access to the HR network share. Only those who are authorized to change data get the ability to write or delete data. Others may only get read access. And just because a user is in HR doesn't mean they get access to all folders (or even get access in general). An HR person in Peru doesn't necessarily need access to HR data from Japan. That might be outside their scope of responsibility, so they don't get access if not needed. By reducing the access an organization is able to protect sensitive data as unauthorized persons do not get access to it. This makes is more difficult for an unauthorized person to extract sensitive data from an organization. By using role-based access controls, the authorized persons still get easy and convenient access. ESGranting access isn't the hard part, the hard part is doing it in a way that is both convenient for an end user yet difficult for an attacker to usurp or take advantage of
< Page 8 | Page 10 >