Identification Identification is the process by which a subject professes an identity and accountability is initiated. For example, a user provides a username, a logon ID, or a smart card to represent an identification process. Similarly, an application can provide a process ID number as identification. Once a subject has identified itself, the claimed identity becomes accountable for any further actions undertaken by that subject. IT systems track activity by identities, not by subjects themselves. A computer doesn’t know one human from another, but it does know that your user account is different from all other user accounts. (Stewart et al., 2004) All users should have a unique identifier (user ID) for their personal use only, and a suitable authentication technique should be chosen to substantiate the claimed identity of a user. (NL ISO/IEC, 2010) Authentication Authentication is the process of verifying or testing that a claimed identity is valid. Authentication requires that a subject provide additional information that must correspond exactly to the professed identity. An authentication system checks the professed identity and the authentication against a database. If the database includes the identity and the correct authentication is included, the subject is authenticated. The three basic methods of authentication are also known as types or factors. Type 1: A Type 1 authentication factor is something you know. It is any string of characters you have memorized and can reproduce on a keyboard when prompted. Examples include a password, personal identification number (PIN) , passphrase, or mother’s maiden name. Type 2: A Type 2 authentication factor is something you have. It is a physical device that you must have in your possession at the time of authentication. Examples include a token device, smart card, memory card, or USB drive. Type 3: A Type 3 authentication factor is something you are or something you do. It is a physical characteristic of a person identified with different types of biometrics. Examples in the “something you are” category include fingerprints, voice prints, retina patterns, iris patterns, face shapes, palm topology, and hand geometry. Examples in the “something you do” category include signature and keystroke dynamics, also known as behavioral biometrics. (Stewart et al., 2004) Authorization Authorization indicates who is trusted to perform specific operations. If the action is allowed, the subject is authorized; if disallowed, the subject is not authorized. Lebanese National Security Policy Guidelines v1.7 Page 18 |