课程: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

免费学习该课程！

今天就开通帐号，24,600 门业界名师课程任您挑！

Authentication/session management issues

Authentication/session management issues

课程: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

开始一个月试用 购买团队方案

Authentication/session management issues

“

- [Narrator] Software developers rely upon authentication systems to validate the identities of users and make authorization decisions. We've already talked about a few application authentication concepts, but let's take a look at a couple of issues of specific importance to software developers. First, you should never store user passwords in plain text form. Storing passwords exposes them to the risk of theft. Instead, you should store passwords in hashed and salted form. Hashing a password uses a cryptographic algorithm to transform the password into a value that can't be reversed. This allows for the verification. Then a password is correct by comparing hash values, but it doesn't allow someone with a hash file to recover the passwords because the hash function is irreversible. Salting the passwords prior to hashing them adds a random value to the password. This is a control that's necessary to protect against a specific type of attack called a rainbow table attack, where the…

内容