381 VIEWS
Pinterest LinkedIn LINE

Password management in a certain place has become a topic of discussion, so here is a sneak peek at the objectives and threats section of the requirements I use for managing credentials, including passwords. It is based on ISO/IEC 29115, with just a few additions of my own.

9.2 Credential Verification/Authentication

What matters in the authentication phase is achieving an appropriate authentication level by combining various means.

9.2.1 Objectives and Threats

The objective of credential verification/authentication is to indirectly verify a user’s identity by verifying possession of credentials, thereby enabling services to be provided only to the intended user.

Threats in this situation include the following.

Threat

Description
ID-fixed attack An attack that attempts to log in by trying multiple passwords against a single ID.
Password-fixed attack An attack that attempts to log in by trying multiple IDs against a single password.
Credential-stuffing attack An attack that attempts to log in by trying combinations of IDs and passwords obtained by some means.
Compression-ratio observation attack An attack that sends different strings, observes the compression ratio of the responses, and infers the secret key.
Timing attack An attack that tries different cryptographic keys, observes response times, and infers the key itself.
CSRF (when entering a password) An attack that uses scripts or automatic forwarding (HTTP redirects) to make a user enter a password on another website and steal it.
Clickjacking An attack that overlays a different screen on the user’s display and tricks the user into clicking.
Phishing (password theft) A type of credential duplication in which the subject is deceived into presenting credentials to an illegitimate CSP.
Eavesdropping An attacker observes an authentication transaction and subsequently uses it.
Replay attack An attacker obtains an authentication message and reuses it.
Session hijacking Hijacking a session established by the subject. Example: intercepting and using an authentication cookie.
Man-in-the-middle attack An attacker inserts themselves between the subject and the system and controls the session by relaying communications.
Credential theft An attacker uses a stolen device containing stored credentials.
Impersonation attack Impersonating biometric information, for example by using a gummy finger.

 

This incident appears to be the “password-fixed attack” among these, also known as a “reverse brute-force attack.” The source document goes on to define 19 corresponding controls, which are combined as countermeasures. Incidentally, all 19 basic controls are mandatory.

So, everyone, how much of this have you implemented?!

Also, if there is anything you think should be added, please let me know.

See you!

Related posts