Multi-factor Authentication

There are three regulatory approved factors of authentication, all forms of authentication can be grouped under one of the following:

• Something you know
• Something you have
• Something you are

Two-factor authentication is when two of those three authentication types is used in conjunction with each other. The most commonly seen use of this is debit/credit cards(something you have) with a pin(something you know).

Something you know

The weakest form of the three and the most commonly seen in the form of passwords or pins. One of the most troublesome issues with this form is that there is no regulation around how it is kept secure. A password can be shared or exposed through many methods without the keepers knowledge. Often there are technical constraints imposed on the creators of passwords which limits their entropy and the keeper needs to be able to remember them which makes it easy for them to be guessed.

Something you have

This form of authentication has been around for centuries, most commonly seen in the form of a key to a lock. The formal description for this is that the key embodies a shared secret between the lock and the key.
There are four ways of attacking such a system:

• Attack the authenticator or management system to try determine the secret.
• Steal the 'something you have'
• Make a copy of the 'something you have'
• A man-in-the-middle attack where the attacker sits in between the communication channel of each entity

Something you are

The strongest factor of authentication and typically seen in the form of biometrics, something you are can compose of many things such as finger prints, iris scans, voice patterns etc. They are very susceptible to replay attacks.

Cookies

Cookies were originally designed to add persistence to the state, a website or user had taken in the past. Although cookies can not contain virus' or malware. In the modern web environment, cookies perform several critical functions. The most common of which is authentication cookies, used to know if a user is logged in or not.

The current specification (October 2011) for cookies is rfc6265

The types of cookies

• Session Cookie
• Persistent Cookie (also known as tracking cookies)
• Secure Cookie
• Http Only Cookie
• Third Party Cookie
• Super Cookie
• Zombie Cookie

Session Cookie

This type only lasts for the duration the user is on the website. To be a session cookie, no 'Expires' directive is provided when it is created.

Persistent Cookie

This type will outlast user sessions and has a max age of 1 year. Each time the site is visited the initial value set in this cookie will be provided. This could contain how the user originally came to the site, which is why it is also known as a tracking cookie.

Secure Cookie

This type has a secure attribute enabled and can only be used through HTTPS, ensuring encryption when it is transmitted between the client and the server.

Http Only Cookie

Supported by most modern browsers, this type is transmitted only when transmitting HTTP/HTTPS requests. With this, the access by client side javascript or other non-html code is mitigated. This does not totally eliminate the risk through XSS.

Third Party Cookie

This type are ones that have the domain set to a different one to the address being visited. Advertisers use this commonly to track a users browsing history.

Super Cookie

This type has a domain set as merely a top-level suffix, such as .com - security settings usually prevent this type.

Zombie Cookie

This type is recreated by other means automatically after the user has deleted it. This could be done through a variety of ways such as local flash storage.

A web browser is generally accepted to be able to store at least 300 cookies of 4Kb each and at least 20 cookies per server or domain.

Three Types of Access Control

Administrative

These security controls are put in place to define and guide employee actions in a workplace when dealing with sensitive information. E.g. Policy might dictate that HR do background checks on all employees with access to sensitive information.

Technical

These are devices, processes, protocols and other measures used to protect C.I.A of sensitive information. These might include logical access systems (Lock and key), encryption systems, antivirus systems, firewalls etc

Physical

Security controls are devices and means to control physical access to sensitive information and its availability. Examples could be a physical access systems (fence, guards etc), physical intrusion detection systems (motion sensor, alarms etc) or physical protection systems such as fire alarms, backup generators.

RSA and DSA

DSA (Digital Signature Algorithm) is an Asymmetric encryption algorithm that is known for being fast at cryptographically signing but slow at verifying. Slow at encrypting but fast at decrypting.
RSA (named after its published creators Rivest, Shamir and Adleman) and is also an Asymmetric encryption algorithm.

To define the difference between Asymmetric and Symmetric encryption: Symmetric relies on a single private key mixed with secret input - you can use block or stream ciphers. Asymmetric uses a combination of a public and private keys and require fixed bit lengths such as 1024, 2048 etc. The public key is allowed to be distributed so long as the private key remains secure. The private key is used for digitally signing where the public key can be used to verify the integrity of that.

The encryption is done through the intended recipients public key and the creators private key, then the combination of the recipients private key and senders public key can decrypt it.

DSA is based on a discrete logarithmic problem. RSA is based on the difficulty in the factorization of large integers.

RSA is far more common and commercially accepted. While it is possible for DSA to be over 1024 bits, many applications limit it to this. As such 2048 RSA algorithms are widely accepted as the minimum security standard to be cryptographically secure.

Android SSL/TLS

The javax.net.ssl packages provide all the necessary classes and interfaces required to program secure socket abstractions based on the SSL protocols SSLv3.0 / TLSv1.1.
All of the details of the SSL handshake protocol are accounted for and the client or a server can specify the cipher set to use. X.509 Certificates are verified and if desired, the client and server each have the option of verifying the entire certificate chain until the root Certificate Authority is reached.
Android uses code from the Legion of the Bouncy Castle and OpenSSL.

Defence in Depth

Defence in depth is a security and information assurance concept in which multiple layers of security controls are placed throughout an IT system. Its intent is to provide redundancy should the event of a security control fail or a vulnerability is exploited. So should a system fail or the bad guy managed to defeat it, there would still be a variety of fallbacks to protect the network. Firewalls for homes are not as popular as they used to be due to the increase use of home routers which act as a hardware firewall for all inbound connects unless outbound traffic to that destination has preceded it.

Defence in depth measures should not only prevent security breaches but also buy an organisation time to detect and respond to an attack, thereby reducing and mitigating the consequences of attack.

VPN Basics

a Virtual Private Network is a technology that provides secure communication through an insecure and untrusted network (like the internet). It achieves this through authentication, encryption, compression and tunneling.

What is tunneling?

Tunneling is a technique that encapsulates packet headers and data within the payload of another protocol. This way the packet can traverse the network in a manor it would otherwise not be capable of traversing.

How is it done?

The most common ways of creating a VPN are IPsec and SSL/TLS.

IPsec

IPsec provides authentication,encryption and compression at the network level. IPsec is actually a suite of protocols developed in the mid 90's and supports both IPv4 and IPv6. However it is mandatory in IPv6 and optional in IPv4. To implement IPsec two new protocols were added: Authentication Header (AH) and Encapsulating Security Payload (ESP). Handshaking and exchanging session keys are done using the the Internet Key Exchange (IKE) protocol.
The Authentication Header is protocol number 51 and it authenticates both the header and the payload. The AH however does not use encryption so it is almost never used.
Encapsulating Security Payload is protocol number 50. It enables you to add a security policy to the packet and optionally encrypt it. The encryption is done in the kernlet via the cryptoAPI. When two machines are connected via the ESP protocol, a unique number identifies the connection. This number is called the SPI (Security Parameter Index). Each packet contains a sequence number and a checksum which is called the ICV (Integrity Check Value). The checksum is calculated using a secret key which is known only to these two machines.

IPsec has two modes: Transport and Tunneling. When creating a VPN, we use tunnel mode. This means that each IP packet is fully encapsulated in the new IPsec packet. The payload of this new packet is the original packet before it was encapsulated.

The problem with this model is that in networks where the peer is behind a NAT (Network Address Translation) device. Using a NAT is a common way of connecting machines that are not directly accessable to the outside world. The NAT is performed on a machine that does have access, this is usually a gateway. The NAT modifies the IP packet and as a result the peer rejects it because the signature is wrong. The solution is commonly known as NAT-T (Network Address Translation Traversal) and works by encapsulating the IPsec packet in UDP packets so that they'll be able to pass through the NAT routers without being dropped.

OpenSwan is an open-source project that provides an implementation of IPsec. The SWAN name comes from Secure Wide Area Network which is actually a trademark of RSA. OpenSwan supports Opportunistic Encryption (OE), which enables the creation of IPsec based VPNs by advertising and fetching public keys from a DNS server.

SSL/TLS

OpenVPN is a VPN solution based on SSL/TLS. It is simpler in comparision with IPsec and OpenVPN supports RSA authentication, Diffie-Hellman key agreement, integrity checks etc. When running in server mode, it can support up to 128 clients over the same port. You can setup your own Certificate Authority and generate certificates and keys for an OpenVPN server and multiple clients.

OpenVPN operates in user-space mode; this makes it easy to port to other operating systems.