- [Narrator] Password security has many levels.
System usernames are usually the same
as a user's email address,
so guessing that portion isn't difficult.
When an attacker gains access to a login prompt
and hammers away guessing passwords,
it's called an online attack.
When an attacker takes a hashed password
or other encrypted password and decrypts it,
this is called an offline attack.
It's for this reason that enterprises create and implement
a password policy.
This will not only dictate how complex a password must be
but also how frequently the password will expire
and need to be replaced.
Multifactor authentication is also another security measure
that can be applied to simple passwords.
Passwords are something you know
but multifactor will also test against something you have.
For example, some systems will allow you
to enter a username and password,
you will then be texted an additional password
that will allow you to proceed with the system.
Biometric credentials can be used
for two-factor authentication when utilizing a badge
and a fingerprint to open a door.
It can also be used for single-factor authentication
as in the case of unlocking a cell phone
with facial recognition.
Digital certificates are a form of time-sensitive security.
Certificates are electronic documents
that prove the ownership of a public key.
Certificates are issued by a certificate authority.
If a certificate is valid
and the software utilizing the certificate
trusts the issuer, then the software can use the cert
to securely communicate between endpoints.
As discussed in the first CCNA course,
centralized password authentication is a best practice
for maintaining usernames and passwords across a network.
It's called AAA for Authentication,
Authorization and Accounting.
Authentication is verifying who a user is.
Authorization is determining what they are allowed to do.
And accounting is tracking what they did.
This is accomplished either via
the Cisco propriety TACACS+ system
or the open standard RADIUS system.
In essence, an administrator runs either
a TACACS+ or RADIUS server
and network equipment runs a client
that will make the proper request to the server.
Password security and management has long been a struggle
in the enterprise.
An efficient engineer should take every advantage like AAA
that can make the process simpler.