application_security/authentication

146 notes in this subject, read out of this brain and free to use. This is page 3 of 3.

Identity-Based Attacks defense with Zero Trust

Sophisticated attacks like Pass-the-Hash and Golden Ticket steal identity tokens to impersonate legitimate users. Zero Trust uses short-lived tokens with continuous validation, device binding, and behavioral analysis to detect unusual access patterns.

Multi-Factor Authentication MFA most secure options

Most secure and highly phishing-resistant MFA options are: FIDO2 hardware security keys (physical devices using public key cryptography), WebAuthn-based platform authenticators (passkeys using fingerprints or face recognition), and smart cards or PIV cards (PKI-based authentication).

Multi-Factor Authentication MFA good options

Good MFA options are mobile apps using TOTP-based authenticator applications and backup codes for when primary methods fail.

Multi-Factor Authentication MFA avoid SMS

Avoid SMS-based MFA because it is vulnerable to SIM swapping and phishing attacks.

Conditional access for high-risk situations requires stronger MFA

Set up conditional access so high-risk situations require stronger authentication.

OMB M-22-09 mandates phishing-resistant MFA for U.S. federal agencies

OMB M-22-09 mandates phishing-resistant MFA for U.S. federal agencies.

User account management: use one identity system

Do not have multiple user databases. Use one centralized identity system.

User account management: automate account creation

Set up role-based access automatically instead of manual account provisioning.

User account management: separate admin accounts

Do not use regular accounts for administration. Maintain separate administrative accounts.

Access control: least privilege principle

Give the minimum access needed to do the job.

Access control: just-in-time access

Provide elevated access only when needed for a specific task.

Access control: no permanent admin rights

Remove always-on administrative privileges.

Access control: smart decisions

Consider user role, location, and device when granting access.

Device security: certificate-based device identity

Use PKI certificates to uniquely identify and authenticate each device.

Application security: identity-aware proxy

Check user identity before allowing application access.

Zero Trust implementation Phase 1: set up strong MFA everywhere

This provides significant security improvement. Use FIDO2 hardware keys or biometric authentication. Do not use SMS codes. Plan for user training since this changes how people log in.

Zero Trust implementation Phase 1: control admin access

Set up privileged access management (PAM) for administrative accounts. Remove permanent admin rights and switch to temporary access. This may slow some processes initially.

Zero Trust implementation Phase 2: secure applications

Add identity-aware proxies and web application firewalls (WAFs) that make security decisions based on who is trying to access what, not just where they are connecting from.

Legacy system challenge: weak authentication

Many older systems only support basic username/password authentication with no option for multi-factor authentication. Some were built when passwords were considered sufficient. Adding modern authentication requires significant modification or replacement. This creates a security gap where your most sensitive systems often have the weakest authentication.

Legacy system solution: security proxies and wrappers

Let you add modern authentication and security controls in front of systems that cannot support them natively. The proxy handles strong authentication, multi-factor verification, session management, and other Zero Trust verification, then passes authenticated requests to the legacy system using whatever method it understands. This might include identity-aware proxies, application firewalls, or API gateways. This approach works particularly well for web-based legacy applications.

Legacy system solution: protocol translation

Translation gateways can convert modern authentication tokens (like SAML or OAuth) to whatever format the legacy system expects (like Kerberos or basic auth), bridging the gap between old and new security approaches. This helps when you have systems that use old authentication methods but cannot be modified.

Multi-cloud: connect identities

Use the same login across all clouds.

Common mistake: making security too hard for users

If your Zero Trust implementation makes it painful for people to do their jobs, they will find workarounds that bypass your security. The key is balancing security with user experience. Use risk-based authentication so low-risk activities are seamless, and only add friction when the risk level justifies it. Test your policies with real users before rolling them out.

Common mistake: forgetting about legacy systems

Many Zero Trust projects focus on new, cloud-native applications and ignore older systems that cannot support modern authentication. These legacy systems often contain your most sensitive data and become the weakest links in your security chain. You need a strategy for protecting systems that cannot be easily upgraded.

Access control DoS defense: prevent user lockout abuse

Be aware that user lockout mechanisms can be abused by attackers to cause DoS. An attacker can trigger repeated failed login attempts to lock out legitimate users.

Access control DoS defense: authentication as privilege enforcement

Use authentication to restrict access to potentially damaging functions. The principle of least privilege reduces DoS attack surface by denying attackers ability to access functions exploitable for DoS.

Give your agent this brain