Password-Based Authentication

Users log in with a username and password.

• Strengths
  • Easy to use and set up.
  • Familiar to most people.
• Weaknesses
  • Prone to hacking if passwords are weak or reused.
  • Vulnerable to phishing attacks.

Multi-Factor Authentication (MFA)

Requires more than one way to verify identity, like a password plus a code sent to your phone.

• Strengths
  • Adds extra security layers.
  • Harder for hackers to break in.
• Weaknesses
  • Can be inconvenient.
  • Some methods can still be hacked.

Biometric Authentication

Uses unique body features like fingerprints or facial recognition to verify identity.

• Strengths
  • Harder to fake or steal.
  • Easy for users once set up.
• Weaknesses
  • Biometric data can still be compromised.
  • Privacy concerns about storing personal data.

Token-Based Authentication

Users get a special token to access services instead of using a password every time.

• Strengths
  • Scalable and good for many users.
  • Easy to control access and revoke tokens.
• Weaknesses
  • Tokens need to be kept safe.
  • If not done right, can still be hacked.

Password Guessing

• Attackers try to guess passwords using automated tools or by trying common passwords.
• Weak or easy-to-guess passwords make this attack more likely.
• Example: An attacker tries common passwords like “password123” to access an account.

Brute-Force Attacks

• Attackers try all possible combinations of characters to guess passwords.
• Weak or short passwords are vulnerable to this attack.
• Example: An attacker uses software to try millions of password combinations until finding the correct one.

Credential Stuffing

• Attackers use leaked username/password pairs from one service to access other accounts.
• People who reuse passwords are at risk.
• Example: An attacker uses a list of stolen passwords to try accessing various accounts, like email or banking.

Exploitation and Impact

• These vulnerabilities can lead to unauthorised access to accounts.
• Consequences include data breaches, financial loss, and damage to reputation.
• Prevention includes strong passwords, limiting login attempts, and detecting unusual login patterns.

Password Protection

• Hashing: Convert passwords into unreadable codes before storing them, so even if a database is hacked, passwords are protected.
• Salting: Add random data to passwords before hashing to make them harder to crack.

Secure Communication

• TLS Encryption: Use encryption to safeguard data when it’s transmitted over the internet.
• Strong Algorithms: Employ robust encryption methods to prevent unauthorised access.

Least Privilege

• Only What’s Needed: Grant users the minimum level of access required for their tasks.
• Role-Based Access: Assign permissions based on users’ roles to limit unnecessary privileges.

What is Multi-Factor Authentication (MFA) and Why is it Important?

MFA makes it much harder for hackers to break into accounts because it asks for more than just a password. Instead, it requires two or more types of proof, like:

• Something You Know: Like a password or PIN.
• Something You Have: Like a smartphone or special code generator.
• Something You Are: Like a fingerprint or face scan.

Benefits of Implementing MFA

• Better Security: With MFA, even if someone guesses or steals your password, they still can’t get in without the other proof.
• Harder for Hackers: It’s way more difficult for attackers to break through multiple layers of security.
• Meets Rules: Many rules and laws require strong security measures like MFA to protect sensitive information.
• Easy for Users: Once set up, it’s not too much extra hassle for users, and it keeps their accounts safer.

Session-Based Authentication

• After you log in, the server creates a session ID for you. It’s like a ticket that proves you’re allowed in.
• This ID is stored securely on your device.
• Each time you do something on the website, your browser sends this ID to the server to prove it’s still you.
• Best Practices:
  • Make sure these IDs are hard to guess.
  • Keep them safe on the server.
  • Use HTTPS to protect them from being stolen while traveling over the internet.
  • Set them to expire after a while or when you log out, so they can’t be misused for too long.

Token-Based Authentication (JWT)

• When you log in, the server gives you a token (a digital pass) that contains your info.
• Every time you want to do something on the website, you show this token.
• The server checks the token to see if it’s valid and if you’re allowed to do what you’re asking.
• Best Practices:
  • Use strong encryption for these tokens.
  • Set an expiration time to limit their use.
  • Have a way to cancel them if they’re stolen.
  • Make sure only trusted websites can use them, to stop attacks from other sites.

Challenges

• Different Devices: Phones come in all shapes and sizes, making it tricky to ensure everyone’s data is safe in the same way.
• Internet Issues: Phones switch between Wi-Fi and data all the time, which can sometimes mess with security.
• Typing Troubles: Typing on a small screen can be annoying, so complicated passwords aren’t always practical.
• Risk of Loss: Phones can get lost or stolen more easily than computers, so keeping our stuff safe is even more important.

Best Practices

• Keep Secrets Safe:
  • Hide important stuff like passwords in special secure places on the phone.
  • Use strong codes to keep the secrets safe from sneaky folks.
• Use Your Face or Fingers:
  • Some phones let you unlock them with your face or fingerprint, which is super safe and easy.
  • Make sure the phone keeps this info safe too!
• Use Special Codes:
  • Instead of giving away your password all the time, phones can use special codes that change often.
  • This keeps the bad guys from using old passwords if they somehow get them.
• Double Check with a Friend:
  • Sometimes, it’s good to have two steps to unlock your phone, like both a password and your face.
  • It’s like having two locks on your door instead of one.
• Lock Up What You Send:
  • When you send stuff from your phone to somewhere else, like a website, make sure it’s locked up tight so no one else can see it.
  • Think of it like sending a secret message that only you and the other person can read.

Challenges in IoT Authentication

• Limited Resources: IoT devices often have limited processing power and memory, making it tough to implement strong authentication.
• Diverse Devices: The wide range of IoT devices means there’s no one-size-fits-all authentication solution.
• Physical Vulnerabilities: IoT devices can be physically tampered with, risking the security of authentication credentials.
• Lifecycle Management: Managing the setup and retirement of IoT devices at scale is complex and requires careful planning.

Best Practices for Securing IoT Authentication

• Strong Protocols: Use robust authentication protocols like mutual TLS tailored to IoT device limitations.
• Identity Management: Establish secure methods for assigning and managing unique identities for each IoT device.
• Secure Communication: Encrypt communication between IoT devices and cloud services to prevent unauthorised access.
• Role-Based Access Control: Implement role-based access control to limit device access to necessary resources.

Challenges in Cloud Computing Authentication

• Identity Complexity: Managing identities across various cloud services and users can be challenging.
• Shared Responsibility: Cloud security is a shared responsibility between providers and users, which can lead to confusion.
• Credential Management: Safely managing authentication credentials like API keys and access tokens is vital.
• Integration Complexity: Integrating authentication across different cloud services and systems can be tricky.

Best Practices for Securing Cloud Authentication

• Identity Federation: Enable single sign-on across cloud services using identity federation mechanisms like SAML or OAuth.
• Multi-Factor Authentication: Require multiple forms of authentication for added security.
• Centralised IAM: Use a centralised platform to manage user identities and permissions consistently.
• Continuous Monitoring: Keep an eye on authentication events in real-time and enforce compliance policies.