TASK 11 By luke

Two-Factor Authentication

Two-factor authentication, or 2FA, is a security system that requires two forms of authentication before allowing access to whatever data is being protected [6]. For example, requiring a password or PIN (personal identification number) as well as a code sent to the users smartphone, can be sufficient; even a fingerprint works in some cases. This latter example comes from a form of verification known as biometric authentication, which can use your face, fingerprint, or retina to verify the user's identity [6]

There are many forms of authentication factors, however, and each one should be used for maximum security if you want your system to be as protected as possible. These forms include the knowledge factor, possession factor, biometric factor, location factor, and time factor. Knowledge factors are something only the user would know, like a password or PIN. A possession factor is something that the user would have, like an ID card or cellphone. A biometric factor is something that is a part of the user's physical identity, like their face or fingerprint. A location factor is typically where the authentication request is being made; access can be limited to some parts of the world in some circumstances. Finally, the time factor restricts access to a specific time window during the day, which can be useful in some cases [7].

Penetration Testing

“Penetration testing” is another way to protect your system, and it is something that Bank of America should maybe look into. It is when a cybersecurity expert (a.k.a an “ethical hacker” tests your system's security by quite literally hacking into it and searching for weaknesses that real hackers could and would use to gain access to your information [5]. They utilize methods such as phishing, or even direct attacks on the system, to identify any gaps in the system security that they can. Naturally, after all the tests have concluded they report back to the company what kind of improvements they could make to their systems defenses.

The best analogy I heard to describe the definition of penetration testing would be a “bank hiring a burglar to rob them” [9];

By testing the system's security in the form of simulated attacks, the system will be better prepared if a real hacker comes along to test the system's capabilities. As for how the tests are conducted, there are many different forms of pen tests (penetration tests). The first would be an open-box pen test. This is when the hacker is provided some basic information about the company’s security system beforehand, giving them an advantage. The second would be a closed-box pen test, which is also known as a “single-blind” pen test. This occurs when a hacker is given nothing but the name of the company. The third is a covert pen test, also known as the “double-blind” pen test. This is where almost no one in the company knows the pen test is occurring, including the security personnel who will be responding to the said attack. This is a difficult pen test. The fourth, an external pen test, is when the focus is placed on the publicly available systems, or the companies external-facing technology. In certain situations, the hacker cannot even enter the premises of the building, and must hack from an undisclosed location nearby. The fifth and final pen test is known as an internal pen test, which is similar to an external pen test, only the hacker is testing the company’s internal network, usually from within the building; this is useful for determining what damage an “insider” could cause, or an angered employee [5].