In this next module, we'll describe some of the common security controls that are used to protect operating systems. We'll review the purpose of user accounts, and also look at where user accounts are stored and managed. We'll also look at good practice for creating strong passwords, as well as other alternatives to using passwords on modern systems. At the end of this module, you'll be able to understand how we use identity as an authentication, define good practice for creating passwords, understand common password cracking techniques. Recognise the benefit of using two-factor authentication and know how Windows controls authorisation with rights and permissions. Some of you've mentioned an important job of an operating system is to manage security. And this involves many different types of controls. Cyber security involves putting systems and controls in place to manage the security of devices and information. Security professionals will think about how to control security by referencing the CIA Triad. As you can see, the CIA Triad contains three elements, confidentiality, integrity and availability. Confidentiality of information covers how we protect it, so it can only be accessed by authorised people, software and systems. For example, personal information, like an employee's pay details is something that would need to be kept confidential. Integrity, is about the accuracy of information. If, for example, you send an email to someone saying you'll give them £10, and when the email arrives in your friend's mailbox, it says you'll give them £100, something has affected the integrity of the message. Availability, is about making sure authorised people can get access to the information when it's needed.

If a system is down, or it's running slowly, the information won't be available. And if there's too much security, the information might also be too difficult to access. Security professionals will look at different types of information and decide on what's the right balance of each of these three things, because it is about a balance. If we make something too confidential, it might become too difficult to access. Or, we might make it too easy to access, and we could affect its confidentiality and its integrity. Your profile and security settings on social media should only be accessible by you. So, its confidentiality is important, but you still need to be able to access it, and it needs to be correct. If you think about something like a company's public website, they want that sort of information to be available to as many people as possible. So, availability is very important, and as it's public information, the confidentiality is less important, but they do need to make sure to protect the integrity. They wouldn't want somebody hacking into their website and making changes. So, we need a different balance of confidentiality, integrity, and availability for different types of information. And, we use controls to put this in place. One of the most fundamental controls that's used to enforce security is through identity. And, identity is used by people, devices and software to state who they are. We get access to personal information, apps and other things as individuals by using an identity. But of course, it's no good just saying who we are, we need to prove that and this is what we do when we authenticate. So, authentication is the process of stating our identity and then proving who we are.

When we log into computers, websites and apps, we're authenticating to prove who we are. We often authenticate ourselves by using a password, and this is something we'll cover in some more detail later. But once we have authenticated and proved who we are to the system, it can then determine what we're allowed to do and what we're allowed to access. And this is called authorisation and it's used to control things like what apps we can run, what data files we can gain access to and what type of access we have, such as read or write. And then finally, operating systems will do some form of accounting or auditing. And this means keeping track of what's happened on the system, such as when somebody logs in or runs a programme. This information stored in log files, and it can be used to investigate problems with the system, or in the event of a security issue, it might help track how a systems being accessed by a malicious user. Have you ever thought about where and how your identity information's being stored? Depending on what we need to do and access, there are many places where identity information can be stored. At home, when we use computers, we need to log in, and this is usually done with a local account. A local account is an identity which is stored and used only on that local computer. When we use cloud services, we'll have an identity in the cloud system. And, this'll usually give us access towards the cloud providers' services. Modern operating systems, like Windows and Mac OS, give us an option at home to use a single identity when we log in. We get authenticated with both our local account and our cloud account at the same time.

In businesses, where there are lots of identities to manage, there'll typically be a central identity provider which is responsible for the central management, storage and authentication of many identities. An example of a central identity provider is Microsoft Active Directory, which is very common on business networks. One of the goals of a business network is to provide single sign on, people need to work efficiently, but at the same time we need to maintain the right balance of security. In a business environment, people might need to get access to lots of different systems. And it would be very complicated if they had to remember lots of different log in details and passwords. Single sign on is the capability that allows someone to authenticate once, and then get access to all the resources they need securely, without having to keep providing different log on details. Centralised identity services, such as Active Directory on a company network, allow this to be put in place. But of course, what we should think about here, is that it means if someone manages to get access to your account they're going to be able to access all of your stuff. So, security of identity is a critical thing for everyone, and it's the first line of defence on business networks to protect people, information and systems. For people, a user account is used for their identity, when user accounts are created, they can be set up to have different levels of privileges. On most operating systems, there are some standard levels of privileges for users, such as normal users and administrative users. The different between these two types of account is really important. Standard user accounts have sufficient access to the system to be able to do normal, day-to-day things, such as running apps, access to the internet and editing documents.

Administrative accounts on the other hand, can do all these things and a lot more, such as editing important system settings and changing the operating system software. Now, this can be really dangerous, as someone with administrative provision to the system could damage it or even use it for malicious purposes. Think about the computers that you use at home, do you log on with an administrative account? You should understand that if using an admin account, all the apps that you run have administration privileges to the system. So, imagine for example that you clicked on a dodgy link in an email, or a website, that downloaded some code onto your computer without you realising. If this code runs, it would have your administrative privileges, and it could be used to change your system, install malware, or steel personal data. For this reason, it's good practice to use a normal account for day-to-day activities and create a separate admin account for times when you need to make configuration changes. It's also good practice not to share accounts and make sure that each user of a system has their own personal account. This is standard practice in a business network, but often it'll be taken one step further. A business will identify specifically what different types of access people need, and they'll allocate more specific access based on this. And, sometimes this is referred to as role-based access control. It's about making sure people have enough access to be able to do the job, but no more access than they need. And that way, if their account did get broken into, the damage of what can be done is limited. And it also means that people can't abuse the level of access to the system.

Operating systems can also give a very high level of privilege, known as system or route. This is only given to the operating system components themselves so they can do the job. If a malicious user was able to gain system-level access to the computer, they'd be able to do pretty much anything. When we're dealing with lots of user accounts, it becomes difficult to manage and control access. And, this is where groups come in, a group is basically a collection of users of computers. And, when we place users of computers into groups, we can assign access for things for the group, and everyone in the group gets that access. So, if an administrator wants to give a new employee the same access as their colleagues, it simply becomes a process of putting them in the same group. So, if an administrator wants to give a new employee the same access as their colleagues, it simply becomes a process of putting them in the same group. Windows comes with some pre-created groups which can be used to give users access to things without needing to give them administrative accounts. Normal users are added to the users group, which gives them all of the standard privileges that a normal user needs to run programmes and access the data. If they need extra privileges they can then be added to other groups which will only give those specific extra things. For example, the backup operators group can backup and restore files without needing to be given specific access to them. And, the remote desktop users group can connect their computers over the network with a remote user session. When you make an account an admin account, it gets its administrative access by being made a member of the administrator's group. On business networks, members of the administrators group should be very limited, and these accounts should only be used when strictly necessary.

One of the most common methods we use to authenticate to computers and online services, is with a password. So, what makes a good password? In our slide, we've got some useful tips to help you create good, strong passwords, or passphrases. We should start by thinking about passphrases, rather than passwords. A passphrase will include a set of words, whereas a password might only contain one. Because we use a password for so many things, it's really important that we understand how to keep our account safe by using strong passwords that can't be stolen or cracked by criminals. Firstly, create long passphrases rather than using words that appear in dictionaries. Or, easy to guess, like names of family members and pets. Password cracking tools used by criminals, use customised word lists that can help them crack passwords by looking for common words. And, these tools are quite clever, they'll also try substituting letters for numbers and symbols. So, for example, trying words using the number three instead of the letter E. They'll also try different combinations of upper case and lower case letters to see if they can find a match. Always use a strong and separate password for your email. Our email account is one of the most important accounts, as we often send and receive sensitive information via emails. However, what we must also think about, is that we usually sign up for online accounts and apps via email, and then we use our email address to log in. Our email address then becomes the method for sending us password reset links when we've forgotten those passwords. So, if somebody can get access to your email, it might be possible for them to send password reset links from other sites and change lots of your passwords and gain access to your account and information.

And, this technique is often used by criminals who hijack people's social media accounts and then use them for criminal activities. And remember, in a business, attackers might try and impersonate others, which is going to be much easier if they've got access to somebody's email. As we have so many passwords, and we need to keep them strong, it's tempting to use the same email address and password for multiple sites. And, this is something that you should always avoid. If criminals manage to successfully break into an online system and steal people's log in details, including passwords, they'll either use them or more likely sell them on black markets to be used by other criminals. The first thing that's often done by these types of criminals is to try the same username and password details on other sites to see if they can get in. So, always make sure the passwords used for each site and app are different. It can be years before these types of attacks surface, by which time people have forgotten about any security incident that might've affected one or more of their accounts. And, finally, never share your password with anyone. It might be tempting to let other people borrow your account for something, but this is a dangerous thing to do. It might actually be illegal in some cases. Businesses will always set up separate accounts for each user, and they should never share the details with each other. And banks and online services will never ask you for your password, so be very suspicious if anyone calls you, or sends a text or email and then goes on to ask you for your password. Never give it out. The National Cyber Security Centre provides guidance on how we can create secure passwords and their advice is to use three random words.

Creating passwords from three random words will make them long enough and strong enough for most cases, but also make them easier to remember. Now, many online systems will force you to create complex passwords that contain combinations of upper and lower case letters, as well as numbers and symbols. If a system needs you to create complex passwords, think about how it could also fit these in with your three random words, so that the phrase doesn't become too difficult to remember. And, if you are finding it difficult to remember passwords, it's also okay to write passwords down, as long as you keep them in a safe place. In most cases, our passwords are not stored or transferred in plain text, instead they're stored as hashes. Most operating systems use hashing to store passwords, as do some online systems. A hashing function is a one-way mathematical calculation which is generally difficult to reverse. If we put some information through a hashing function, the output will always be the same length for any given input, but we can't derive the input from the hash. The hashing algorithm will always generate the same output for the same input. And, this means we can use the hash to tell whether information that's put into the algorithm is the same or different. Some systems also use assault, which is an extra input to the hashing algorithm which adds extra length to the input to make it even more difficult to work out what the correct input is for a given hash. When we log into operating systems with a password, the operating system generates a hash from the password we input and compares that to a hash it stored when we created the password. If the two hashes match, we must've supplied the correct password and we'll get logged in.

So, operating systems generally compute the hash for a password during the log in process, and compare the calculated hash to the one stored to confirm that the password provided was correct. If criminals were to steal password data, they might only get a set of hashes. However, the mathematical algorithms used to generate the hashes are well known. So, they can try different inputs to these algorithms, and if they can generate the same hash, they then know what the password is. There are lots of password cracking tools, and many of these are freely available. These tools will typically use a dictionary or a word list of common passwords which are passed through the hashing algorithm to try and generate the same hashes as those that have been stolen. Another technique, is to use a brute force attack where every possible combination of characters is used to get a match. The success of a dictionary attack is based on whether the password can be found in the list. Whereas a brute force attack would always be successful eventually, so using longer, more complex passwords, makes this more difficult and time consuming. A rainbow table is a list of pre-computed hashes which allows password cracking tools to more quickly discover what input was used for a given hash. There are many huge lists of pre-calculated hashes on the internet. If a password cracking tool has a hash, and looks it up in one of these tables, the table will give the input that was used. And, this means the password can be cracked very quickly compared to churning through millions and millions of different combinations, like stunning a brute force attack.

Using a password manager can be a great way to help us to use different, good, strong passwords for all of our accounts, without the pain of having to remember them all. A password manager is an app which can store all of your passwords securely and automatically enter them when they're needed. Password managers are usually kept secure with a master password, so this is something you'll still need to think about and keep safe. Modern web browsers have a built-in password manager that can remember the passwords for websites that you visit. It's safe to do this on your own device, but don't save passwords in your browser on shared computers outside of your home. There are also dedicated password manager apps in cloud services, some of these are free and some of these need to be paid for. If you're planning to use a password manager app, it's worth doing some research before choosing one. And remember, that if someone can get access to the app, they're going to have access to all of your passwords. With modern technology, there are other ways to authenticate than using passwords. Two factor authentication describes how we use more than one method to prove who we are. Using an extra factor makes it much more difficult to gain access to systems if they know a password, we can combine different factors together and many online systems and apps support using two factor authentication. The factors we use can be different combinations, from things that we know such as a password, things that we have, such as a mobile phone, something we are, such as a scan of a fingerprint, or even something we do such as the way we type or move a mouse.

For example, if we combined a password with a mobile phone to log in, as well as typing the password, we might need to receive and enter a code sent by text, or by using an app. If someone steals the password, but doesn't have the phone, they won't be able to log in. And likewise, if they've got the phone, but don't know the password, they still can't log in. So, to get in, a criminal would need to have access to both things at the same time. Many businesses will require that the users use two-factor authentication, especially for cloud accounts. A popular factor is an authentic app like Microsoft Authenticator. This can be installed on a mobile phone and set up to receive an approval request, or it can generate a code when an account is used for authentication. With this type of set up, you can even go password-less. Many online services are also now supporting passkeys. Passkeys aim to make all of your accounts more secure by using password-less log in, in place of traditional passwords. Each passkey is a unique digital key that can't be reused. They're also stored in an encrypted format on your devices, instead of on company servers, which keeps them safe in the event of a data breach. And, people can't get access to your passkey with phishing attacks either, two-factor authentication is one of the best things you can do to protect your online accounts. So, it's worth enabling it wherever you can, particularly for your email account. Remember, authorisation is the process of controlling what people can do. Once a user has been authenticated, the operating system can then perform authorisation. When we get access to things using operating systems, our access is controlled by using permissions and rights.

Now, although these words are often used interchangeably, they actually mean different things on Window's computers. On Window's a permission gives access to something, for example, a user might be given read only access to a file. A right is a privilege to carry out an action, for example running a programme, or changing the time. An important aspect of securing a business network is to control permissions and rights and not give people more than they need. Remember on a business network, we only want to give users enough access, so granting the right levels of permissions and rights is really important. Typically, groups are used to assign both permissions and rights rather than giving them to individual users. There are built in groups on Windows and Mac OS, and there are built in groups in Active Directory, and in cloud services. These can all be used to grant specific sets of rights and permissions, and administrators can also create their own custom groups. It's now time to do our next lab. In this lab, you're going to create and test new user accounts on the business network. You'll start by creating a new account that you can use for ongoing admin of the Windows server, and then you'll add it to a group to assign the admin privileges. You'll then test the account to demonstrate that it can perform the same task as the built in administrator account. And if you want to have a try at demonstrating and testing how other types of permissions and rights can be assigned, why not try the If Time Permits exercises.

Module 2: Accounts and passwords

About