a.
Multi-Factor Authentication (MFA) greatly enhances the security of online accounts and
sensitive systems by requiring multiple forms of verification;
i. What is Multi-factor Authentication?
ii. With the aid of a diagram explain the Four(4) authentication categories in Multi-factor
Authentication
iii. Describe a real-life scenario that incorporates all Four(4) authentication categories in a
secure multifactor authentication system.
b. Mention and explain any Two(2) types of Access Control
c. Briefly explain the following key aspects of Operating System Security
i. Security Policies
ii. Security Models
iii. System Hardening
d. You are the Chief Information Security Officer (CISO) of a mid-sized e-commerce
company.
Recently, your company has experienced a series of security incidents, including unauthorized
access attempts, suspicious network activity, and malware infections. In order to address these
issues, you are expected to convince your boss about the implementation an Intrusion
Detection System (IDS).
i. State and explain the Four(4) primary goals of an IDS
ii. What are the characteristics exhibited by systems not under attack based on the principles of
intrusion detection?
SOLUTION
a. Multi-Factor Authentication (MFA)
i. What is Multi-Factor Authentication?
Multi-Factor Authentication (MFA) is a security mechanism that requires users to provide two or
more different types of credentials to verify their identity before gaining access to a system,
application, or resource. It significantly strengthens security by ensuring that even if one
authentication factor is compromised, unauthorized access is still prevented by the additional
layers of verification.
ii. Four Authentication Categories in MFA
The four authentication categories are:
1. "What you know": Information that only the user should know, such as passwords, PINs,
passphrases, or answers to security questions.
2. "What you have": Physical or digital items in the user's possession, including
smartphones, hardware tokens, smart cards, or authenticator apps.
3. "What you are / do": Biometric characteristics unique to the individual, such as fingerprints,
facial recognition, iris scans, voice patterns, or DNA.
4. "Where you are": Geographic or network-based authentication using GPS coordinates, IP
address ranges, or specific network locations.
iii. Real-Life Scenario: High-Security Banking System
Consider a high-security corporate banking system that implements all four authentication
categories:
Scenario: A bank executive accessing the institution's core financial management system from
their office.
What you know: The executive enters their complex 16-character password and answers a
dynamic security question based on recent account activity.
What you have: They use their company-issued smartphone to receive a time-sensitive
SMS code and simultaneously present their physical smart card to a card reader at their
workstation.
What you are / do: The system requires both fingerprint authentication on a biometric
scanner and facial recognition through the workstation's camera to verify their identity.
Where you are: The system validates that the access attempt originates from the
executive's registered office IP address range and confirms their GPS location matches the
bank's headquarters coordinates.
Only when all four factors are successfully verified simultaneously does the system grant
access to the sensitive financial data and transaction capabilities.
b. Two Types of Access Control
1. Discretionary Access Control (DAC)
DAC is a flexible access control model where resource owners have the discretion to determine
who can access their resources and what level of access to grant. The owner of a file, folder, or
system resource can directly assign permissions to other users or groups. This model is
commonly used in traditional operating systems like Windows and Unix/Linux, where file
owners can modify permissions using commands like chmod or through graphical interfaces.
While DAC provides flexibility and ease of administration, it can create security vulnerabilities
since users may inadvertently grant excessive permissions or fail to revoke access when
needed.
2. Mandatory Access Control (MAC)
MAC is a more rigid access control model where access permissions are determined by
system-wide security policies rather than individual user discretion. The system enforces strict
rules based on security labels, clearance levels, and predefined policies that cannot be
overridden by users. MAC is commonly implemented in high-security environments such as
military systems, government agencies, and classified data centers. Examples include SELinux
(Security-Enhanced Linux) and systems using Bell-LaPadula or Biba security models. This
approach provides stronger security assurance but requires careful policy design and can be
more complex to administer.
c. Key Aspects of Operating System Security
i. Security Policies
Security policies are formal documents that define the rules, procedures, and guidelines
governing how an organization's computing resources should be protected and used. In the
context of operating systems, these policies specify acceptable use standards, access control
requirements, data handling procedures, incident response protocols, and compliance
requirements. They serve as the foundation for implementing technical security controls and
ensuring consistent security practices across the organization. Effective security policies must
be clearly written, regularly updated, communicated to all users, and enforced through both
technical measures and administrative procedures.
ii. Security Models
Security models are theoretical frameworks that define how security policies are implemented
and enforced within an operating system. These models provide structured approaches to
controlling access to resources and maintaining system integrity. Common security models
include the Bell-LaPadula model (focused on confidentiality and preventing unauthorized
disclosure), the Biba model (focused on integrity and preventing unauthorized modification), the
Clark-Wilson model (emphasizing commercial security requirements), and the Chinese Wall
model (preventing conflicts of interest). These models help system architects design security
mechanisms that consistently enforce desired security properties throughout the system.
iii. System Hardening
System hardening is the process of securing an operating system by reducing its attack surface
and eliminating potential vulnerabilities. This involves disabling unnecessary services and
features, removing default accounts and passwords, applying security patches and updates,
configuring secure network settings, implementing proper file permissions, enabling logging and
monitoring, and installing security software. Hardening also includes configuring firewalls,
disabling unused network ports, implementing strong authentication mechanisms, and
establishing secure system configurations. The goal is to minimize potential entry points for
attackers while maintaining system functionality and performance.
d. Intrusion Detection System (IDS) Implementation
i. Four Primary Goals of an IDS
1. Detection and Identification: The primary goal is to identify and alert security personnel
about potential security threats, unauthorized access attempts, malicious activities, and
policy violations in real-time or near real-time. This includes detecting both known attack
patterns and anomalous behavior that may indicate new or unknown threats.
2. Monitoring and Analysis: IDS continuously monitors network traffic, system logs, user
activities, and system resources to analyze patterns and behaviors. It correlates events
from multiple sources to provide comprehensive visibility into the security posture of the
organization's infrastructure and identify complex, multi-stage attacks.
3. Incident Response Support: The system provides detailed forensic information, attack
timelines, and evidence collection capabilities to support incident response teams. It helps
security analysts understand the scope, impact, and methodology of security incidents,
enabling faster and more effective response and recovery efforts.
4. Compliance and Reporting: IDS generates detailed reports and documentation required
for regulatory compliance, security audits, and management reporting. It maintains logs of
security events, system activities, and response actions to demonstrate due diligence and
meet various compliance requirements such as PCI DSS, HIPAA, or SOX.
ii. Characteristics of Systems Not Under Attack
Based on intrusion detection principles, systems not under attack typically exhibit the following
characteristics:
Normal Traffic Patterns: Network traffic flows follow predictable patterns with typical
bandwidth utilization, standard communication protocols, and regular connection patterns
between known hosts. There are no unusual spikes in network activity or connections to
suspicious external addresses.
Stable System Performance: System resources such as CPU, memory, and disk usage
remain within normal operating parameters. There are no unexplained performance
degradations, unusual process activities, or abnormal resource consumption patterns that might
indicate malicious processes or system compromise.
Consistent User Behavior: User activities follow established patterns with normal login times,
typical application usage, standard file access patterns, and expected privilege escalation
requests. There are no unusual account activities, off-hours access attempts, or access to
resources outside normal job functions.
Predictable Log Patterns: System and application logs show consistent, expected entries with
normal error rates and typical administrative activities. There are no unusual error messages,
failed authentication attempts, or unexpected system changes that might indicate compromise
or attack attempts.
These characteristics form the baseline for normal system behavior, allowing the IDS to
effectively identify deviations that may indicate security threats or attacks in progress.