Instructor: In this lesson,
we will learn about user identity control.
User identity control is the process used to manage,
verify, and secure the identities of users
to ensure they have appropriate access to resources.
User identity control concepts include credentials,
the use of biometrics, and multi-factor authentication.
Credentials are the information that users provide
to prove their identity.
Biometrics like facial recognition
and fingerprints may also be used to validate identity.
Authentication is then the process
of validating user presented credentials or biometric data
to confirm a user's identity.
Authorization is then used to determine
what resources the authenticated user is allowed to access.
Finally, multi-factor authentication
or MFA requires users to provide
two or more verification factors
before being granted access to the enterprise network.
Let's learn more about credentials, the use of biometrics,
and multi-factor authentication.
First, we have credentials.
Credentials are the information users provide to a system
to verify who they are.
The most common types of credentials are passwords,
personal identification numbers, and digital certificates.
For example, when you log in to a system such as your email
or work account, you're likely asked
to enter a username and a password.
The password is your credential proving
that you have legitimate access to that account
and that you are who you say you are.
Passwords are the most basic
and widely used form of credentials,
and their simplicity makes them easy
to implement across almost any system.
However, the simplicity of credentials
is also what makes them vulnerable.
Passwords can be guessed, stolen, or forgotten.
For example, a weak password like
123456 or P-A-S-S-W-O-R-D can be easily cracked
by attackers using automated tools.
Even strong passwords can be compromised
if they are reused across multiple sites
or if they're exposed in a data breach.
Digital certificates are another form of credentials
that provide a higher level
of security compared to passwords.
Certificates are electronic documents
that verify a user's identity
using cryptographic techniques.
They are commonly used in environments
that require strong authentication
such as securing access to corporate networks or websites.
For example, when you access a secure website,
your browser uses digital certificates to confirm
that the site is legitimate
and establish a secure connection.
Similarly, certificates can be used
to authenticate users proving their identity without relying
on easily compromised credentials like passwords.
Second, we have biometrics.
Biometrics are a method of identity control
that uses a person's unique physical
or behavioral traits to verify their identity.
Instead of relying on something a user knows
like a password, biometrics rely on something a user is,
making it a powerful tool for secure authentication.
Common types of biometrics include fingerprints,
facial recognition, iris scans, retina scans,
and voice recognition.
These characteristics are hard to replicate,
making biometrics much more secure
when compared to traditional credentials.
For example, when you unlock your smartphone
using your fingerprint,
the device matches your fingerprint against a stored image
of your print to confirm that it is really you.
This process is quick, convenient,
and provides a high level of security
because fingerprints are unique to each individual.
Similarly, facial recognition works by scanning the features
of your face and comparing them to a stored template.
So biometrics offer an easy
and fast way to verify your identity without the hassle
of having to remember a password
or personal identification number.
However, biometric systems are not perfect
and are measured using key metrics
like the crossover error rate or CER,
the false acceptance rate or FAR,
and the false rejection rate or FRR.
The crossover error rate is a standard measurement used
to determine the accuracy of a biometric system.
Crossover error rate represents the point
where the rate of the false acceptances
and the false rejections are equal
when multiple systems are compared.
A lower crossover error rate indicates
the more accurate system as it reflects a balance
between security and usability.
The false acceptance rate measures
how often a biometric system incorrectly accepts
an unauthorized person.
For example, if a facial recognition system
mistakenly identifies a stranger as an authorized user,
this is a false acceptance.
High false acceptance rates
mean that the system is not secure enough
as it allows unauthorized access.
On the other hand, false rejection rate measures
how often the system wrongly rejects an authorized user.
For example, if you try to unlock your phone
with your fingerprint,
but it fails to recognize you, this is a false rejection.
High false rejection rates can be frustrating
because they make the system inconvenient, denying access
even when the correct person is trying to authenticate.
So balancing the false acceptance rate
and false rejection rate is important
to creating a biometric system
that is most secure and user-friendly.
The goal is to minimize both rates
and achieve that low crossover error rate,
providing a system that correctly identifies users
with high accuracy.
Overall, biometrics offer a strong, convenient
and reliable method for user identity control,
enhancing security by using traits that are unique
to individuals and difficult to replicate.
Third and last, we have multi-factor authentication or MFA.
To improve the security of your network, use MFA
which requires two or more independent factors
to verify a user's identity.
These factors include something you know,
something you have, something you are,
and somewhere you are.
This approach as layers of security
to the authentication process, making it much harder
for unauthorized users to gain access.
In multi-factor authentication,
the first factor, something you know, involves information
that the user knows, such as a password,
personal identification number,
or answers to security questions.
The second factor, something you have,
relies on a physical item in the user's possession,
such as a smart card, key fob,
or smartphone that receives authentication codes.
The third factor, something you are involves biometrics
such as fingerprints, facial recognition,
or voice patterns, which are all unique to an individual.
The fourth factor, somewhere you are
uses geographical location data like GPS
or IP addresses to verify
that the user is in an authorized location
when attempting access.
Using only one of these factors is known
as single factor authentication.
This would be like logging in with a password alone.
Combining two different factors,
such as using a personal identification number,
and a smart card creates-two factor authentication,
which is also called 2FA.
2FA significantly increases security.
Multi-factor authentication or MFA
goes a step further by combining two
or more distinct factors such as a smart card,
a biometric scan, and a location verification
to provide even greater protection.
High security environments often use
multi-factor authentication with multiple factors
to safeguard sensitive information.
As security threats evolve,
so do authentication methods including advanced options
like time-based one-time passwords, or TOTP
and hash-based message authentication code
one-time passwords or HOTP,
which generate single-use codes that change frequently.
Multi-factor authentication can also be implemented in band
where the authentication code is received on the same device
used for access or out of band
where the code is received on a different device altogether,
adding an extra layer of security.
So if your organization requires higher security,
consider implementing two-factor
or multi-factor authentication,
especially using out-of-band methods
to enhance the offenses against unauthorized access
and protect critical systems and data.
So remember, user identity control
is the process of managing,
verifying, and securing user identities
to ensure appropriate access to resources.
It involves using credentials, biometrics,
and multi-factor authentication to confirm user identity
and maintain security credentials such as passwords,
personal identification numbers
and certificates are the most basic form of verification
that users provide to prove their identity.
Biometrics use physical traits like fingerprints
and facial recognition to validate users, adding a layer
of security beyond what the user knows.
Multi-factor authentication
or MFA combines multiple authentication factors
requiring users to provide two
or more types of verification, such as something they know,
something they have, something they are,
or somewhere they are
to strengthen the authentication process.