1 Data Access Control, Password Policy and Authentication Methods for Online Bank Md. Mahbubur...

Data Access Control, Password Policy and Authentication Methods for Online Bank

Md. Mahbubur Rahman Alam

B. Sc. (Statistics) Dhaka UniversityM. Sc. (Statistics, Major in Econometrics) Dhaka University

PGD(ICT)BUETM. Sc. (ICT) BUET

Assistant Professor, BIBM, Mirpur, Dhaka.Cell: 01556323244, Mail: alam_mr@yahoo.com Website: mralam.net

InternetCustomer

POSTPSTN

Branch

Other Bank

Mobile

Call Center

3Md. Mahbubur Rahman Alam, Assistant Professor (ICT), BIBM. Mail: alam_mr@yahoo.com

Data access typically refers to

software and activities related

to storing, retrieving, or acting

on data housed in a database

or other repository. Data

Access is simply the

authorization you have to

access different data files.

Data Access Control

Md. Mahbubur Rahman Alam, Assistant Professor (ICT), BIBM. Mail: alam_mr@yahoo.com

Access Controls

Access Controls should provide reasonable assurance that data and

applications are protected against unauthorized modifications,

disclosure, loss or impairment. Such controls include physical

controls, such as keeping a computer in a locked room to limit

physical access, and logical controls such as security software

programs designed to prevent or detect unauthorized access to

sensitive files.

Implement Separation of duties (SOD) a preventive control.

Establish test and production environments which are

preventive control.

Restrict user account and Database administrator access which

is a preventive control.

Restricting Access

Elements to restrict include:

Data access (Successful/Failed Selects)

Data Changes (Insert, Update, Delete)

System Access (Successful/Failed Logins);

User/Role/Permissions/Password changes

Privileged User Activity (All)

Schema Changes (Create/Drop/Alter Tables, Columns, Fields)

Identification, Authentication and Process

Authentication Methods

We can authenticate an identity in three ways:

Something the user knows (such as a password or personal

identification number)

Something the user has (a security token or smart card)

Something the user is (a physical characteristic, such as a

fingerprint, called a biometric). Md. Mahbubur Rahman Alam, Assistant Professor (ICT), BIBM. Mail: alam_mr@yahoo.com

Fingerprint RecognitionHand or Palm Geometry

Facial Recognition

Eye Scans

USB Security Token or One Time Password

RSA stands for Ron Rivest, Adi Shamir and Leonard Adleman

RSA Security LLC

Login Authentication

AUTHENTICATION

Database ServerVerifies Trusted Connection

Database ServerVerifies Name and Password

ORDatabase Server

Windows 2000 Group or User

Windows 2000 Group or User Windows 2000

Database ServerLogin Account

Database User Accounts and Roles

Database Server Assigns Logins to User Accounts and Roles

DatabaseUser

Database Role

Windows 2000Group User

Database ServerLogin Account

Database Server Verifies Trusted Connection

Database ServerVerifies Name and Password

Database Server

Windows 2000

Database ServerChecks Permissions

Permission Validation

Permissions OK; Performs Command

Permissions not OK; Returns Error

2222 3333

SELECT * FROM MembersSELECT * FROM Members

Database UserExecutes Command

Granting Permissions to Allow Access

User/RoleUser/RoleUser/RoleUser/Role SELECTSELECTSELECTSELECT

EvaEva

IvanIvan

DavidDavid

publicpublic

INSERTINSERTINSERTINSERT

UPDATEUPDATEUPDATEUPDATE

DELETEDELETEDELETEDELETE

Denying Permissions to Prevent Access

EvaEva

IvanIvan

DavidDavid

publicpublic

Revoking Granted and Denied Permissions

EvaEva

IvanIvan

DavidDavid

publicpublic

Password Policy

Use of both upper- and lower-case letters (case sensitivity)

Inclusion of one or more numerical digits

Inclusion of special characters, e.g. @, #, $ etc.

Prohibition of words found in a dictionary or the user's personal

information

Prohibition of passwords that match the format of calendar dates,

license plate numbers, telephone numbers, or other common

numbers

Prohibition of use of company name or an abbreviation

Password Duration

Some policies require users to change passwords periodically,

e.g. every 90 or 180 days. The benefit of password expiration,

however, is debatable. Systems that implement such policies

sometimes prevent users from picking a password too close to a

previous selection.

Common Password Practice

Never share a computer account

Never use the same password for more than one account

Never tell a password to anyone, including people who claim to

be from customer service or security

Never write down a password

Never communicate a password by telephone, e-mail or instant

messaging

Common Password Practice

Being careful to log off before leaving a computer unattended

Changing passwords whenever there is suspicion they may have

been compromised

Operating system password and application passwords are

different

Password should be alpha-numeric

Never use online password generation tools

Password strength is a measure of the effectiveness of a

password in resisting guessing and brute-force attacks. In its usual

form, it estimates how many trials an attacker who does not have

direct access to the password would need, on average, to guess it

correctly. The strength of a password is a function of length,

complexity, and unpredictability.

Password Strength

MFA, two-factor authentication, TFA, T-FA or 2FA is an approach

to authentication which requires the presentation of two or more of

the three authentication factors: a knowledge factor ("something

only the user knows"), a possession factor ("something only the user

has"), and an inherence factor ("something only the user is"). After

presentation, each factor must be validated by the other party for

authentication to occur.

Multi-factor Authentication (MFA)

Something only the user knows (e.g., password, PIN, pattern);

Something only the user has (e.g., ATM card, smart card, mobile phone);

Something only the user is (e.g., biometric characteristic, such as a

fingerprint).

Multi-factor Authentication (MFA)

Questions are

Welcome

Thank You

1 Data Access Control, Password Policy and Authentication Methods for Online Bank Md. Mahbubur...

Documents

Transcript of 1 Data Access Control, Password Policy and Authentication Methods for Online Bank Md. Mahbubur...

Mahabubul Alam Rasel

khursheed alam project.doc

Md. Taskin Alam

Timing Alam

S. M. Mahbubur Rahman, Ph.D. · C.V. of S. M. Mahbubur Rahman, Ph.D. July 2018 Page 1 of 21 S. M. Mahbubur Rahman, Ph.D. E-mail: mahbubur@eee.buet.ac.bd . Home page:

Bencana Alam

alam el halfa

Haroon alam

azad alam alig

Topics in Networking1 Data Link Layer Services and Protocols Arzad A. Kherani (alam@cse.iitd.ac.in) Dept. of Computer Sc. And Engg. Indian Institute of.

Financial Services to Enable SME Growth Syed Mahbubur Rahman Managing Director & CEO perspective.

DSU Revised Budget 2015-16 Mahbubur Rahman Vice President (Finance & Operations) 18 November,2015.

Alam Issues/Memon Alam April 2010.pdf · News & Views GUJRATI SECTION URDU SECTION Khawateen ka Alam Bacho ka Alam Interview - Muhammad Ali Tabba Biography - Sir Abdullah Haroon miti

Computer Networks, Jan-May 20041 Computer Networks (Lecture 5: Network Layer Protocols ) Arzad Kherani (alam@cse.iitd.ac.in) Dept. of Computer Sc. And.

Md. Mahbubur Rahman Deputy Director Bangladesh Bureau of Statistics.

2-STOREY TERRACE HOMES | 20’ x 60’ · 2020. 12. 14. · SK Puncak Alam SMK Puncak Alam UiTM Puncak Alam Campus Tesco Alam Jaya Commercial Centre Econsave CONNECTIVITY EDUCATION

International Crimes Tribunal-1 [ICT-1] 2019/June/Mahbubur...ICT-BD Case No. 01 of 2018 Chief Prosecutor vs. Md. Mahbubur Rahman @ Mahbub @ Mahebul 1 International Crimes Tribunal-1

Modern Systems Analysis and Design Technologies and Applications by Mahbubur Rahman Syed & Sharifun Nessa Syed

Smk Alam Megah 2 to Seko...Etia Alam - Google Maps_Part1

Mobile Banking Bangladesh Institute of Bank Management Mirpur, Dhaka-1216. Presented By Md. Mahbubur Rahman Alam B. Sc. (Statistics) Dhaka University M.