Identification, Authentication and Authorization - Quiz

Correct option:
FALSE

Explanation:
Identification and authentication are two distinct processes:

• Identification is the process of claiming an identity (e.g., entering a username or providing an ID). It's essentially saying, "I am [this person]."

• Authentication is the process of verifying that the claimed identity is valid (e.g., entering a password or using biometric data). It’s the step where the system checks if the user is indeed who they claim to be.

Thus, while they are related, they are not the same.

Correct option:
All the above options

Explanation:
To protect an SSO token from theft, spoofing, or forgery, multiple methods are typically employed:

1. Invalidate the SSO token on server-side after logout: This ensures that the token cannot be used for subsequent authentication once the user logs off, preventing unauthorized access.

2. Digitally sign and encrypt the token: Digital signing helps protect the token against man-in-the-middle (MITM) attacks by ensuring its integrity, while encryption adds an additional layer of protection, especially by using time-variant encryption that changes over time.

3. Set the "HttpOnly" attribute for cookies: This prevents client-side JavaScript from accessing the token stored in cookies, reducing the risk of cross-site scripting (XSS) attacks.

All of these methods collectively help ensure the security of the SSO token.

Correct option:
A mechanism that enables a user to sign-in/login/authenticate to an application/system with their credentials only once, and then seamlessly access other applications/systems available in the same domain of trust (e.g. intranet portal of an organization).

Explanation:
Single Sign-On (SSO) is a user authentication process that allows a user to access multiple applications or systems with a single set of login credentials (e.g., username and password). After the initial login, the user can seamlessly navigate to other applications or systems within the same trusted domain without needing to re-enter credentials.

Correct option:
TRUE

Explanation:
Authorization is the process of granting or denying access to resources or actions based on the user's identity and permissions. However, authorization can only be performed after identification (the process of identifying the user or system) and authentication (the process of verifying that the identified entity is legitimate). Without these initial steps, the system would not know who the user is or whether they should be granted access to the requested resources.

Correct option:
An open standard that allows users to share personal resources stored on a site with another site, without having to share their credentials.

Explanation:
OAuth (Open Authorization) is an open standard for access delegation. It allows users to grant third-party applications limited access to their resources (like data) on another service without sharing their credentials (such as username and password). For example, a user might allow an application to access their Google contacts, but the application would not have access to their Google password. OAuth allows this secure delegation of access through access tokens, rather than exposing the user's credentials.

Correct option:
A system or entity which can verify and prove identity to other systems/entities involved in the SSO mechanism. Typically, this is also the entity that generates and verifies the SSO token.

Explanation:
In an SSO (Single Sign-On) solution, the identity provider (IdP) is the entity responsible for authenticating the user and verifying their identity. It provides identity information to other systems (called service providers) by generating and verifying the SSO token or authentication assertion, which allows users to access multiple applications without needing to authenticate again.

The IdP does not necessarily encrypt or provide passwords directly to other systems; instead, it manages user credentials and authentication.

Correct option:
All the above options

Explanation:
All of the listed protocols are commonly used for Single Sign-On (SSO):

• OpenID Connect is a protocol that works on top of OAuth 2.0, allowing users to authenticate with an identity provider.
• SAML (Security Assertion Markup Language) is an XML-based protocol that allows secure exchange of authentication and authorization data between an identity provider and a service provider.
• Kerberos is a network authentication protocol that uses secret-key cryptography for authenticating users and services.
• OAuth is a token-based protocol primarily used for authorization but can also be used as part of SSO implementations.

Thus, all of these protocols can be used for implementing SSO.

Correct option:
Cross-origin information leakage

Explanation:
The SameSite cookie attribute is designed to prevent cross-origin information leakage by controlling how cookies are sent with cross-site requests. This helps protect against cross-site request forgery (CSRF) attacks by ensuring that cookies are only sent in first-party contexts (i.e., when the user is interacting directly with the site that set the cookie).

It does not directly prevent SQL injection, server misconfiguration issues, or XSS attacks.

Correct option:
The process where stolen account credentials (usernames and/or email addresses and the corresponding passwords), mostly from a data breach, are used to gain unauthorized access.

Explanation:
Credential stuffing is a type of cyberattack where attackers use stolen account credentials (username and password pairs) from one data breach to try and gain unauthorized access to users' accounts on other websites. This works because many people reuse the same login credentials across multiple services. If attackers have access to a breached dataset, they can automate login attempts on various websites, hoping to find users who have reused their credentials.

Correct option:
B) and C)

Explanation:
Principal authentication involves verifying the identity of an entity (such as a person, device, or group) based on a unique identifier associated with that entity.

• B): Refers to an entity (e.g., a user, device) being authenticated using a unique identifier.
• C): Describes how a person or entity can be authenticated by a system through the use of an identifier (like a user ID).

Option A) is not specific to principal authentication and seems unrelated to the context of this question. Therefore, B) and C) are the correct options.