Sy0 601 07

Lesson 7
Implementing Authentication Controls

Topic 7A
Summarize Authentication Design Concepts
CompTIA Security+ Lesson 7 | Copyright © 2020 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 2
Syllabus Objectives Covered
• 2.4 Summarize authentication and authorization design concepts
Identity and Access Management
Authentication Factors
Authentication Design
Multifactor Authentication
Authentication Attributes
Activities
1. What is the difference between authorization and authentication?
2. What steps should be taken to enroll a new employee on a domain network?
3. True or false? An account requiring a password, PIN, and smart card is an
4. example of three-factor authentication.
5. What methods can be used to implement location-based authentication?
Topic 7B
Implement Knowledge-based Authentication
• 1.2 Given a scenario, analyze potenial indicators to determine the type of attack
• 3.8 Given a scenario, implement authentication and authorization solutions
• 4.1 Given a scenario, use the appropriate tool to assess organizational security
(Password crackers only)
Local, Network, and Remote Authentication
Kerberos Authentication
Kerberos Authorization
PAP, CHAP, and MS-CHAP Authentication
PAP CHAP
Short for Password Authentication Protocol Abbreviation of Challenge-Handshake Authentication Protocol
Described in RFC 1334 Described in RFC 1994

Initialized by the client Initialized by the server
Authentication is performed during the initial establishment
Authentication is performed only once during a session when of connection; authentication can also be requested and
the initial connection is established performed after the connection has been established
(midsession authentication)
Used by Point-to-Point Protocol (PPP) to validate users and to
Used by Point-to-Point Protocol (PPP) to validate users and to
describe password authentication in other protocols such as
authenticate in other protocols such as RADIUS and Diameter
RADIUS and Diameter
Uses a Two-Way Handshake mechanism Uses a Three-Way Handshake mechanism
Provides no protection against replay attacks Provides protection against replay attacks
Sends the password in clear-text form, which makes it
Requires the client and the server to know the password in a
vulnerable to even the simplest Man-in-the-Middle (MITM)
clear-text form but never sends the password over a network
attacks.
Supported by RADIUS as RADIUS PAP and therefore Supported by RADIUS as RADIUS CHAP and therefore
supported by Rublon Multi-Factor Authentication supported by Rublon Multi-Factor Authentication
Password Attacks
Brute Force and Dictionary Attacks
Password Crackers
Authentication Management
Activities
1. Why might a PIN be a particularly weak type of something you know

authentication?
2. In what scenario would PAP be considered a secure authentication method?
3. True or false? In order to create a service ticket, Kerberos passes the user's
password to the target application server for authentication.
4. A user maintains a list of commonly used passwords in a file located deep within
the computer's directory structure. Is this secure password management?
5. Which property of a plaintext password is most effective at defeating a brute-force
attack?
Topic 7C
Implement Authentication Technologies
• 3.3 Given a scenario, implement secure network designs (HSM only)
• 3.8 Given a scenario, implement authentication and authorization solutions
Smart Card Authentication
Key Management Devices
Extensible Authentication Protocol/IEEE 802.1X
Remote Authentication Dial-in User Service
Terminal Access Controller Access-Control System
Token Keys and Static Codes
Open Authentication (OATH)
2-Step Verification
Activities
1. True or false? When implementing smart card logon, the user's private key is stored
on the smart card.
2. You are providing consultancy to a firm to help them implement smart card
authentication to premises networks and cloud services. What are the main
advantages of using an HSM over server-based key and certificate management
services?
3. Which network access control framework supports smart cards?
4. What is a RADIUS client?
5. What is EAPoL?
6. How does OTP protect against password guessing or sniffing attacks?
Topic 7D
Summarize Biometrics Authentication Concepts
Biometric Authentication
Fingerprint Recognition
Facial Recognition
Behavioral Technologies
Activities
1. Apart from cost, what would you consider to be the major considerations for
evaluating a biometric recognition technology?
2. How is a fingerprint reader typically implemented as hardware?
3. Which type of eye recognition is easier to perform: retinal or iris scanning?
4. What two ways can biometric technologies be used other than for logon
authentication?
Lesson 7
Summary

Sy0 601 07

Uploaded by

Copyright:

Available Formats

You might also like

Sy0 601 07

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sy0 601 07

Uploaded by

Copyright:

Available Formats

Lesson 7

Implementing Authentication Controls

• 2.4 Summarize authentication and authorization design concepts

1. What is the difference between authorization and authentication?

2. What steps should be taken to enroll a new employee on a domain network?

3. True or false? An account requiring a password, PIN, and smart card is an

4. example of three-factor authentication.

5. What methods can be used to implement location-based authentication?

• 3.8 Given a scenario, implement authentication and authorization solutions

Described in RFC 1334 Described in RFC 1994

1. Why might a PIN be a particularly weak type of something you know

• 2.4 Summarize authentication and authorization design concepts

• 3.3 Given a scenario, implement secure network designs (HSM only)

• 3.8 Given a scenario, implement authentication and authorization solutions

• 2.4 Summarize authentication and authorization design concepts

evaluating a biometric recognition technology?

2. How is a fingerprint reader typically implemented as hardware?

3. Which type of eye recognition is easier to perform: retinal or iris scanning?

You might also like