#sc 900

Passwords: -Weakest of authentication methods in AAD -Subject to classic exploitation techniques such as password spraying & bruteforce attacks -Still subject to exploitation even with enforced complexity -Can be combined with other non-controlled application methods to bolster it, such as: -SMS: -SMS is considered less than secure in practical application. -Voice Call

-Can be combined with controlled application methods to bolster it, such as: -Microsoft AuthN App: -Can be used as a primary form of AuthN to sign into an AAD account -Can be used as additional verification option for self-service password reset(SSPR) or AAD multi-factor authentication(MFA) events. -Users must download the phone app & register their account to use this application.

-Open Authentication(OATH) Token One-Time Password(OTP) -Open standard that specifies how time-based OTP(TOTP) codes are generated -Software Token: -AAD generates a secret key, or seed, that is input into the app & used to generate each OTP -Typically an application -Hardware Token: -Small hardware devices that look like a key fob -Secret key/seed programmed into the token -Displays a code that refreshes every 30 or 60 seconds

Passwordless: -Windows Hello -AuthN feature built into Windows 10 -Replaces passwords with strong two-factor AuthN(2FA) on PCs & Mobile Devices -Allows userse to AuthN to: -Microsoft Account -AD Account -AAD Account -Identity Provider Services -Relying party services that support FIDO2 AuthN -Windows Hello is for personal devices. -Uses a PIN or biometric gesture. -Windows Hello for Business is for business owned devices -Uses Key-based or cert-based AuthN -Solves the following problems: -Password reuse -Exposure of symmetric network credentials during/after a server breach -Replay attacks -Password exposure due to phishing

Identity is the primary security perimeter

The four(4) pilliars of Identity: -Administration: The creation & management of identities for users, devices, & services. -Authentication: The act of challenging a party for legitimate credentials. -"AuthN" -Service provided by an identity provider -Multi-factor authentication(MFA) can help make authentication more secure -Something you know(pin, password) -Something you have(trusted device) -Something you are(biometrics)-Evaluating conditions around an authentication request(location, device state) can help make authentication more secure. -Evaluating risk around a user's authentication request -Identity Providers create, maintain, & manage identity info whole providing AuthN services to apps. -Can provide Single Sign-On(SSO) which enables access to multiple resources with a single logon.

-Authorization: The act of processing incoming identity data to determine an appropriate level & type of access. -"AuthZ" -Specifies what resources someone is allowed to access & what they can do with those resources -Role-based Access Control(RBAC) is a collection of permissions of actions that can be performed.

-Auditing: The act of tracking who does what when, where, & how in a system or application.

Identity Federation is a system of trust between two parties for authenticating users & conveying info needed to authorize their access to resources -Enables access across org boundaries by establishing trust relationships between the orgs' identity providers -Typically includes AuthN & AuthZ -Allows admins to implement different and/or more rigorous levels of access control -Active Directory Federation Services(ADFS) ensures that all AuthN occurs on premises & enables implementation of stronger access control

Hashing is a one way function designed to scramble plain text into an unique digest in an indecipherable way.

Hashing has the following requirements: -Must accept any length of characters into its input -Must produce a fixed length of characters for its output -Must be relatively easy to compute -Must not be reversible -Must avoid collisions(having two different inputs that produce the same output)

Defense-in-Depth operates on a principle of not leaning on a singular point of failure. Instead it is the philosophy of putting many "smaller" controls at different points within an environment. This allows for more opportunities for vulnerabilities like misconfiguration, poor policy implementation, legacy systems, & the like to act as a single target for threats.

More eyes watching & make bad actors work harder.