[Day 8] 6. Modern Security Architectures and Authentication Protocols

Next Generation Firewall (NGFW)

NGFWs are the latest evolution in firewall technology. Unlike traditional firewalls, NGFWs offer enhanced security features by integrating multiple layers of security. They are part of the third generation of firewalls, which go beyond simple packet filtering.

Key Features of NGFW:

In-line Deep Packet Inspection (DPI):
DPI inspects the contents of network packets beyond just the header, looking for signs of malicious activity, malware, or intrusion attempts. It analyzes the full content of the data rather than only routing information.
Intrusion Prevention System (IPS):
IPS monitors network traffic for signs of suspicious or malicious activity. If detected, it can actively block or prevent potential attacks in real time. This feature helps prevent vulnerabilities from being exploited.
TLS/SSL Encrypted Traffic Inspection:
NGFWs can decrypt and inspect TLS/SSL-encrypted traffic to detect threats hidden in encrypted sessions (such as malware or data leaks) before re-encrypting it.
Website Filtering:
NGFWs can block access to certain websites based on categories (e.g., social media, gaming, or adult content). This helps organizations manage internet usage and prevent access to harmful sites.
Quality of Service (QoS)/Bandwidth Management:
NGFWs can prioritize or limit bandwidth for certain applications, ensuring critical business processes have the required bandwidth while reducing the impact of non-essential traffic (like streaming or gaming).
Antivirus Inspection:
NGFWs can scan all incoming and outgoing traffic for malware, including viruses, worms, and ransomware, to ensure that no malicious software enters the network.
Third-party Identity Management Integration:
NGFWs can integrate with identity management systems (e.g., LDAP, RADIUS, Active Directory) to authenticate and authorize users or devices trying to access the network. This enhances security by ensuring that only trusted individuals or devices are granted access.

Strong Authentication

Strong Authentication is a security mechanism that uses at least two independent factors to authenticate users. This is done to prevent unauthorized access, even if one factor (like a password) is compromised.

Key Features:

Two Independent Factors:
- Something the user knows (e.g., a password or PIN).
- Something the user has (e.g., a smartphone, security token, or smart card).
- Something the user is (e.g., biometrics like fingerprints or facial recognition).
Non-reusable Element:
- At least one factor must be non-reusable. For example, using a one-time password (OTP) sent via SMS or generated by an app that expires after a short time.

Strong authentication methods significantly improve security over traditional password-based authentication by ensuring that even if one factor is compromised, the other remains secure.

FIDO (Fast Identity Online)

FIDO is a set of protocols designed to make online authentication more secure and user-friendly, focusing on eliminating passwords and reducing reliance on traditional methods.

Key Protocols in FIDO:

Universal Authentication Framework (UAF):
This protocol enables password-less authentication. Users authenticate using a biometric method (like a fingerprint or facial recognition) or a device, eliminating the need for passwords altogether. Once registered, the system recognizes the user and allows access based on their biometric data.
Universal Second Factor (U2F):
U2F adds an additional layer of security by requiring a second factor for authentication. Typically, this second factor is a physical device (like a USB security key or mobile app) that the user must interact with to complete the authentication process. U2F enhances security by making it harder for attackers to compromise an account without access to the physical second factor.

FIDO aims to provide a more secure and seamless user experience by moving away from password-based systems.

Authorization vs Authentication

Authentication is the process of verifying the identity of a user or system. It answers the question, "Are you who you say you are?"
Authorization is the process of granting a user or system permission to access specific resources based on their identity. It answers the question, "What are you allowed to do?"

Delegated Authorization:

Definition: Delegated authorization allows one service (the resource owner) to grant a second service (the third-party application) access to specific resources or actions without giving the third-party full access or control over everything.
Example: Instead of sharing your login credentials, you let a service (like a social media app) access only certain parts of your account, such as posting updates on your behalf.

OAuth 2.0:

Definition: OAuth 2.0 is a protocol used to handle delegated authorization. It allows users to authorize third-party applications to access their resources (like their email or social media accounts) without sharing their username and password with those applications.
Example: You use a fitness app that can access your social media account to post achievements. OAuth 2.0 allows the app to do this without needing your social media password.
OAuth for Authorization: OAuth 2.0 is primarily designed for authorization, meaning it handles granting permissions to access resources, not verifying identity.

OAuth vs. OpenID:

OAuth for Authorization: OAuth 2.0 is intended for authorization, allowing users to give specific permissions to third-party apps.
OpenID for Authentication: For authentication (proving your identity), OpenID is used. OpenID provides a way for users to log in to websites or apps using a trusted identity provider (e.g., Google or Facebook), simplifying the login process.
- While OAuth 2.0 can be used for basic authentication scenarios, it wasn't specifically designed for authentication. OpenID Connect, built on top of OAuth 2.0, addresses this gap by adding authentication features to OAuth 2.0.

Zero Trust Architecture (ZTA)

Zero Trust Architecture (ZTA) is a security model based on the principle of "never trust, always verify." In this model, no one or no device is trusted by default, even if they're inside the corporate network.

Key Principles of ZTA:

Verify Everything:
Every request for access is verified, regardless of whether it's coming from inside or outside the organization. This includes user identity, device health, location, and the specific action being requested.
Multi-factor Authentication (MFA):
To reinforce security, ZTA often requires multi-factor authentication (MFA). Even if an attacker gains access to a password, they still need additional verification (such as a one-time passcode or biometrics).
Access Control:
Access is granted based on the principle of least privilege—only the minimum necessary resources are available to users or devices, reducing potential attack surfaces.

ZTA assumes that attackers are already inside the network, so it focuses on limiting damage and preventing further movement through strong verification and control mechanisms.