In this pocket guide, you’ll find essential information about main security controls. I will explain the concepts, risks, share real-world examples and some interesting, less obvious insights.
Idea
Authentication can be sourced locally, centrally, or from a third-party identity provider.
With local authentication, we store authentication parameters (passwords, for example), directly on the system we are connecting to.
With centralised authentication, we store authentication parameters on a central system, not necessarily the system you are connecting to. Active Directory is a good example. The benefit of having only one authentication storage is reduced attack surface. It is easier to protect one centralised authentication source, rather than multiple smaller authentication sources. It is also easier to enforce expiration, lockout and complexity rules centrally, rather than synchronise the same set of rules across multiple systems.
We can also outsource authentication to a 3rd party Identity Provider (IDP) via federated authentication protocol. OAuth2 and SAML are two examples of such protocols. That relieves us of risks and duties of managing authentication. It is a form of centralised authentication, but the Identity Provider environment is not in our control.
Application examples
Authenticated connections to Youtube.com use Google.com Identity Provider.
Risks
Until recently, local authentication was prevalent. While local authentication is simple to implement, it’s hard to secure due to the complexity of managing numerous systems. It’s now considered a best practice to leverage centralized authentication.
3rd party IDP approach has all the benefits of centralised authentication and ease of management, but it comes with the risks of vendor lock-in. It will be hard to change IDP, if quality of the IDP service degrades, or cost of the service becomes unreasonable.
Quirks
GCP service accounts (SA) and AWS IAM roles use 3rd party IDP authentication under the hood. We don’t store or manage SA’s or roles’ keys (SA user-managed keys is an exception). Authentication in this case is delegated to the respective cloud provider.
Further reading
Pocket Guide: Authentication – Passwords
Pocket Guide: Authentication – Certificates
Please check out the map of cyber security controls below. It is simple yet awesome.
