More and more today, we want to take steps
to secure our networks, including
the access into those networks.
And one of the options of doing that is multi- authentication,
and that's what this video is all about.
So as we discuss authentication, the basic premise
of general authentication is finding out
that Bob, really is Bob, when he's connecting to the network.
And so for a long, long time, we use the username, like,
username of Bob and a password combination.
And that is something that Bob knows. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that is something that Bob knows.
And so to log on the computer, he logs on.
And with single sign on, then he has access--
if we're in Microsoft Active Directory--
Bob's then got access to all those resources
inside of Active Directory, which he is entitled
to through authorization.
In addition, whether a device is wireless or wired,
another way of authenticating user at the network is use
802.1x, which would have a supplicant running
on the client.
An example of a great supplicant in the world of Cisco
is AnyConnect.
So AnyConnect is, like, does it all,
AnyConnect is like the VPN component. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
AnyConnect is like the VPN component.
AnyConnect can be used for posturing
if we're doing posturing with an Identity Services Engine.
And it can also act as a supplicant running
on the computer that's going to provide the credentials of Bob
to get access into the network.
So if AnyConnect is the supplicant
and we're doing authentication at the switch port,
the switch would be the authenticator.
And then the AAA server would be the authentication server.
And when we're authenticating end users,
that's generally going to use RADIUS
between the switch, the authenticator, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
between the switch, the authenticator,
and the authentication server.
In this case, our authentication server,
again, is going to be Identity Services Engine.
But what if we have a device that doesn't have a supplicant
and we still want to identify who they are?
Another option that we can use is web authentication.
And here's the basics for web authentication.
When the computer connects into the network
or tries to, we give them some very basic functionality, like,
DHCP--
if they're a DHCP client, they're going to need that--
and the services of DNS so they can resolve a name
to an IP address. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to an IP address.
But before we allow that traffic from that port
just to do anything they want to,
we're going to go ahead and redirect them over
to a web page.
And that web page is then going to prompt
them to log in if that web page is
on a local device on that network.
Maybe it's a wireless LAN controller, for example,
and that's the web page they're using for authentication.
That would be referred to as local.
Or if the client is redirected to an ISE server,
that would be referred to as central web authentication.
But in either case, were stopping the client WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But in either case, were stopping the client
with a browser interface before they're
allowed to go any further in the network
to put in the credentials of who they are.
Maybe it's a guest user account that they've been assigned,
or if they're Active Directory credentials, which ISE is then
tied into on the back end.
But the key here is that authentication is critical
so we know who the entity is behind the computer
or the networking device.
And these are some creative ways with portals and redirecting
to pause the user for a moment and get that information.
All right, so having said that, let's
talk about what we can do to increase the protection WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
talk about what we can do to increase the protection
and security when a user needs to log
in using multi- authentication.
Sometimes the acronym shows up as MFA
or 2FA, which would be two-factor authentication.
Just think of an authentication like a bucket.
Let's imagine we have three buckets.
And I will put this one in red, I'll put this one in black,
and I'll put this one in green.
And let me label these as category one, category two,
and category three.
And these buckets represent factors. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And these buckets represent factors.
And what multi-factor authentication means
is that before we really believe that Bob
is Bob, if we're doing multi-factor or two-factor
authentication, is that we need to have at least one factor
from two different categories.
And so the question may come up, well,
what are these categories of factors?
The first one is something we've used forever
and that is something that we know, like knowledge-based.
Like if Bob knows what his password is,
that's what he knows.
If Bob knows his mother's maiden name, that's something
he knows.
If Bob knows the last four digits of his social security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If Bob knows the last four digits of his social security
number, again, that's something that Bob knows.
And that would be category one.
So let's imagine.
Let's go ahead and put a password here
as something Bob could know.
And that would be one of the factors.
So if we use at least two different categories,
we have two-factor authentication,
which also can be called multi-factor because it's
more than just one.
So let's take a look at what these other categories could
include.
For category two, is something that the user has.
Now, what could Bob possibly have that would let him in? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, what could Bob possibly have that would let him in?
And one answer would be a little token generator
in a little key fob looking thing.
Or it could be software, and every 60
seconds it generates a code.
And if Bob has that code, maybe we
are prompting him when he logs in,
that he has to know his password,
and he has to put in the code which he has.
And if we're doing that, we're requiring a password
and the token that's being generated
from this little token generator, that
would be an example of multi-factor authentication.
And the third very common element
is something that the user is or something that the user does,
and that would be like biometrics. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and that would be like biometrics.
Maybe a fingerprint reader or something
that scans his eye or retina or iris, looking for details
there.
It could also be something that the user does.
For example, if you and I typed out
a sentence, the same exact sentence, the way
we type it out, the pressure, the frequency,
the time between keystrokes, and so forth
is going to be slightly different.
And a computer could analyze that.
And it could tell the difference between me
typing in that sentence and you typing it in.
And that could be one of the factors, the something the user WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that could be one of the factors, the something the user
is, that's used as part of multi-factor authentication.
Now, the problem with having multi-factor authentication
is you have to get that information into the system.
So the onboarding process for that
would be typing that sentence several times,
or if it's a fingerprint reader, getting that fingerprint
into the system, or the scan of the eyeball
or any part of the eye.
Now, one distinction I like to make to is this.
What if we log into a website and we
have to provide a password, we have to recognize a picture,
and we have to provide the last four digits of our social, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we have to provide the last four digits of our social,
and also maybe a security question, and maybe one
other thing that we have to specify?
If we're asking for one, two, three, four bits of data,
or four different things, is that multi-factor
authentication?
The answer is no.
It's pretty good security.
I mean, we're doing a lot of good stuff that the user knows.
But it's not multi-factor authentication
because it's only using the contents of one category,
something that the user knows.
If we want it to be multi-factor authentication
or two-factor authentication, we have
to have requirements from at least two categories. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to have requirements from at least two categories.
Now, one of the questions is, if we
go to the extra work of doing multi-factor authentication,
including on a smartphone, where maybe
the multi-factor authentication includes a picture,
like, the person looks at the camera,
and it recognizes their face, and boom, lets them in.
They had the passcode to unlock the phone,
and then the visual recognition of their face, that's
multi-factor authentication-- the password and also
their face, that they had.
And let's talk about how that's going
to protect us and the users if we're doing
multi-factor authentication.
If somebody installs a key logger WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If somebody installs a key logger
and is capturing all the keystrokes,
and somebody steals Bob's password,
if we're using multi-factor authentication,
that password by itself is not enough for the attacker
to log in as Bob because he only has one of the factors.
He would have to also have the second or third element
that we're also requiring as part
of multi-factor authentication.
Oftentimes, that second factor is
going to be a token that's generated
by an application or a key fob that's time-sensitive.
So a new token is generated every 60 seconds. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So a new token is generated every 60 seconds.
So if somebody just gets the password of Bob,
they don't have the key generator,
they're not going to be able to go ahead and log in as Bob.
So that means if somebody goes to Bob's machine,
maybe they sneak in at night or whatever,
or they get his laptop and they try to log on,
most systems are going to have controls where
after so many logins it's going to go ahead and give you
a timeout or stop it altogether.
But if it didn't, and somebody tried
to do a brute force attack, or a very extensive dictionary
attack, or they're just trying millions of combinations,
if they don't have that second aspect
of the multi-factor authentication WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of the multi-factor authentication
or the two-factor authentication,
the attacker just won't get in with a password by itself.
It's not enough.
So in this video, we've taken a look
at how we can improve the security and verification
of the entities who are trying to get into our network
by using multi-factor or for using
two, two-factor authentication for access
to our network resources.
And one other challenge I'd like to chat with you about
is what if somebody does have the credentials?
They've got the right username and password combination along
with a token, or a biometric aspect
like an eyeball read or a thumbprint or whatever, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
like an eyeball read or a thumbprint or whatever,
and we--
they pass authentication, do we want
to let every system just get on the network?
And the answer is no.
We might have security policies in place to say, hey,
you have to have an antivirus that was updated
within the last seven days.
Or you have to have this antivirus.
Or you have to have this patch if you're a current Windows 10
user, et cetera, et cetera.
And we can force that with posturing
by using two components, the AnyConnect
client with a posturing module on the client itself,
and ISE, the Identity Services Engine in the background WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and ISE, the Identity Services Engine in the background
doing the enforcement.
And that's what the next video is all about.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.