Exercise 16.9: Authentication and Encryption systems

Question 9.
The use of digital certificates and passports are just two examples of many tools for validating legitimate users and avoiding consequences such as identity theft. What others exist?

Smart card authentication
A smart card is a small plastic card, about the size of a credit card, containing an embedded microchip that can be programmed to store specific user authentication information. The chip on a smart card can store multiple identification factors of a specific user (i.e. password and fingerprint).

Smart cards help to eliminate the threat of hackers stealing stored or transmitted information from a computer. The information is processed on the smart card, so it never has to leave the card or be transmitted to another machine.

Only a limited amount of information can be stored on a smart card's small microchip. For that reason, smart card encryption options are limited. Smaller or shorter encryption keys may be necessary, which heightens the chance of data compromise.

Security token authentication
One-time password (OTP) tokens, also known as key fobs, are a form of authentication that require two factors: something you know and something you have. These tokens are programmed to generate and display new passwords at certain intervals. In order to access a system, a user must enter in his or her user ID and password, which is the first factor of authentication, (something you know) and then provide the PIN displayed on the token, which is the something-you-have authentication factor.

The PIN provided from the token is constantly changing -approximately every 30-60 seconds depending on how it's programmed - and that makes it extremely difficult for a hacker to use that PIN to gain malicious access. Even if the attacker successfully steals the PIN, by the time he or she enters it into the system it will have already changed.

Biometrics
Biometrics is an authentication method that uses fingerprint or facial scans and iris or voice recognition to identify users. A biometric scanning device takes a user's biometric data, such as an iris pattern or fingerprint scan, and converts it into digital information a computer can interpret and verify. Since it is more difficult for a malicious hacker to gain access to a person's biometric data, and it is unlikely that a user will misplace or misuse his or her biometric data, this form of technology a greater level of assurance than other methods of identification.

Fingerprint scanners are one of the oldest forms of biometrics and have been largely reliable when is comes to authentication. These systems are easy to use, but like all authentication products they have some weaknesses. Fingerprints can be copied for malicious access. They can also be troublesome if a user's fingerprint is damaged or altered (eg. a cut or burned finger).

Face and voice recognition systems are similar to fingerprint scanners. Their ease of use makes them favourable, but a user's voice can be recorded and a face can be copied from a photograph, in some cases enabling third-party malicious access to systems.

Iris and retinal scans are considered to be a more secure form of biometric authentication, since copying a person's retinal pattern is a much more difficult task than copying a fingerprint.

Using a keystroke dynamics-based authentication system is another option. This technology measures a users keystroke style and speed (words typed per minute, common errors, letter sequence) and stores that information in a system directory to be used in the future to authenticate a user.

References
Biometric authentication know-how: Devices, systems and implementation (November 05, 2008). Retrieved from SecuritySearch.com at http://searchsecurity.techtarget.com/tip/0,289483,sid14_gci1338503_mem1,00.html
Security token and smart card authentication (November 11, 2008). Retrieved from SecuritySearch.com at http://searchsecurity.techtarget.com/tip/0,289483,sid14_gci1338503_mem1,00.html