M2 - Suggest how users can be authenticated to gain access to a networked system

Different Types of Access Security

Identification - This is when somebody says who they are.

Authentication - This is when somebody proves they are who they say they are, this is usually through some form of ID, i.e. Passport or Driving License.  

Authorisation - This is when somebody gives you permission to do something.

 Two Factor Standard Of Authentication
Two factor standard of authentication is when two different types of proof is necessary. For example when withdrawing money from an ATM you would need a valid debit card and the corresponding PIN number. Two factor standard of authentication is better and far more secure than one factor standard authentication because it requires the attacker to gain two different types of authentication which is much harder than finding out just one. 

Username/Password
This method requires the user to provide a valid username and corresponding password, if either of these is incorrect they will be denied access. This is a good method of authentication because it requires two pieces of confidential information, which can both be updated and changed regularly to keep the account secure. An advantage of using this method of authentication is that there is nothing physical that an attacker can steal, such as an ID card or key. However, a disadvantage of this method is if an attacker got hold of your password (either through a keylogger or by looking over your shoulder, for example.) it would be very easy to gain access to your account.

 Biometrics Authentication
Biometrics is a very unique method of authentication, this is because it can either make decisions based on the users behaviour or their physical attributes. I.e fingerprints, Retina Scan, Palm scan. These are all things an attacker can not physically steal or easily forge, which is what makes this method so secure. The disadvantages of this method are that it is very expensive to set up and maintain and it can also be more time consuming than simply entering a password.


Digital Certificate
A digital certificate is an attachment put on an electronic message as a method of authenticating the person sending the message. The certificate must be obtained through a recognized certificate authority. It basically means when someone is sending personal information it is encrypted, this is important for information such as credit card numbers etc when making online purchases. The information is then decrypted once it has been sent via the digital certificate. The main advantage of this being when a user is entering confidential information they know they can trust the website. One of the disadvantages is that it can be expensive to maintain.




Popular posts from this blog

D1 - Discuss Recent Network Threats

Cross-Site Scripting (XSS) Cross-Site Scripting is a computer security vulnerability that is mostly found in web applications. XSS allows attackers to inject client-side scripts into web pages that are then viewed by others. The people that view this web page can then be infected without even knowing as the page appears to be normal. Depending on what scripts the attacker uses the effects can range from something very minor to a major security risk. XSS can be used to gain control and bypass the authorisation process. SQL Injection SQL Injection is a  technique  used to attack data driven applications and is implemented by adding parts of SQL statements in to entry fields within a website.This is done  in an attempt to get the website to accept a newly formed rouge SQL command to the database. SQL injection is a code injection  technique  that exploits a security vulnerability in an applications software. The vulnerability occurs when the user input field is incorrectly filtered.
Read more

P3 - Explain what an organisation can do to minimise security breaches in networked systems

Policies and Procedures Security Policies A security policy is a document containing the rules and regulations regarding computer network access within an organisation. The purpose of the security policy is so that all the users within the organisation have a set of rules to follow and also so the organisation can protect their devices. The security policy will be constantly changing and being improved because over time they will discover more and more things they have missed out. It is important to have a security policy in place so that all of their data is secure and can only be accessed by authorised people. Education and training All organisations should have policies in place regarding education and training, this is to ensure all colleagues are able to use the latest software and are aware of the latest and best techniques to use when working on the organization's network. If a colleague regularly uses a piece of software, and a 2013 version is released with new helpful
Read more

M3 - Report on the similarities and differences between securing wireless and wired networked systems.

When using a wired network, it is extremely difficult for an attacker to intercept your connection and steal bandwidth, whereas when using a wireless connection others can see and potentially access your wireless network, sometimes within seconds, enabling them to use your bandwidth and steal any information that is shared over the network. Wireless signals can be picked up from somebody in a neighbouring building or sitting in a car near your house, which is why they can be so unsecure. To make the problem worse some routers get delivered with encryption disabled, meaning anybody can connect to the network without having to enter a password, most homeowners don’t know that they need to enable anything leaving them very vulnerable. The good news is that it is not very hard to make your wireless network secure, which will both prevent others from stealing your internet and will also prevent hackers from taking control of your computer through your own wireless network. Changing the
Read more