Do Gun Owners Deserve Data Privacy, Too?

Do Gun Owners Deserve Data Privacy, Too?

Gun Owners and Data Privacy That the United States witnesses an unprecedented number of mass shootings in an average year is beyond dispute. What we've made contentious is where we go from here. No matter how you feel about guns in general, it's clear that
How Machine Learning Quantifies Trust & Improves Employee Experiences

How Machine Learning Quantifies Trust & Improves Employee Experiences

Machine Learning Quantifies Trust Bottom Line: By enabling enterprises to scale security with user behavior-based, contextual intelligence, Next-Gen Access strategies are delivering Zero Trust Security (ZTS) enterprise-wide, enabling the fastest companies to keep growing strong. Every digital business is facing a security paradox today created by
Petteri Ihalainen

Resolved: Username/Passwords Alone MUST Go

Username/Passwords MUST Go

New Year’s Resolution #1 for any cloud IT deployment manager in 2015 ought to be that the user name/password alone must go.  High-profile breaches that exploit username and password-only authorization systems are becoming all-too-frequent events.   The Syrian Electronic Army’s attack on the Associated Press’s Twitter account that caused a 136 Billion dip in the stock market used a spear phishing scheme where employees enter their user names and passwords onto a fake Web site to obtain passwords. So, too, did an eBay intrusion in May 2014 that was also attributed to spear phishing.  And while the details about the November 2014 Sony breach are still unclear, multiple reports indicate that system access ultimately occurred via compromised admin accounts.  (Having a file folder titled Passwords clearly didn’t help either.)

What can cloud IT teams do to minimize the risk of careless disclosure of access credentials to a spear phishing attack?  One answer is to make it impossible for the user to divulge that information, unless the gun is pointed at the users head.

Confidential resources or high level access privileges should have an authentication method associated with it that is impossible to disclose by accident.  Typically these approaches involve multi-factor authentication (MFA) and range on a continuum from one-time-passwords to PKI.  The concept received a boost recently when Microsoft baked multi-factor authentication directly into the Windows 10 operating system, making it as consumer-friendly as possible in hopes of encouraging users to move beyond passwords.

If an enterprise is running a service containing confidential information, with administrators spread all over the globe, and where end user ease of use is required,  it’s best to implement adaptive authentication, where authentication strength matches the confidentiality or access level of a resource.

For applications where payment or high-value information is exchanged, such as in banking,, One-Time Passwords (OTP) are an option enabling a single transaction or entry into a session.  They’re certainly better than weak passwords, but you can still fool a user using a fake web site and using the OTP acquired from the user to access the legitimate resource.

Is Certificate Based Authentication a possible key?

One solution that has been around for almost as long as the password, is a certificate based authentication. The private key is impossible to memorize, and therefore disclose even by mistake. A clear improvement over OTP is a certificate based system, which can include either software-based certificates that are created and installed on the user’s computer, or hardware-based certificates that are created and installed on  a secure element –the chip of a smart card, or a mobile phone’s SIM card.  Both provide improved risk mitigation, even with software based certificate stores.

At the other end of the spectrum is mobile PKI.  If users’ credentials are stored in a tamper resistant environment (Secure Element), even the user can’t view them. When the authentication process begins, the request is sent to the secure element using a second channel (mobile network), and the request includes a clear text part to be signed “Sign in to salesforce.com.” The request is signed by the private key residing in the secure element using a PIN code associated with the key (not the mobile phone PIN).   As a result the system cannot divulge this information, even by accident.   Should someone wish to compromise the whole chain, they would have to have access to your computer, mobile network operator systems as well as your mobile phone OS core functions. Or steal your phone and ask for the PIN code at gunpoint.

It’s time we retire the 50-year old username and password-alone approach to cloud security and move to better approaches to identity relationship and access management.   They exist, they’re readily deployed and proven, and they represent perhaps the best lesson of recent hacks for organizations of all sizes.

By Petteri Ihalainen

Petteri Ihalainen

Petteri Ihalainen is a IAM product manager

TOP ARCHIVES

10 Charts That Will Change Your Perspective Of Big Data’s Growth

10 Charts That Will Change Your Perspective Of Big Data’s Growth

Big Data’s Growth Worldwide Big Data market revenues for software and services are projected to increase from $42B in 2018 ...
6 Robotics Industry Predictions for 2019

6 Robotics Industry Predictions for 2019

Robotics Industry Predictions It's clear that robotics will have a dominant influence on 2019, but how might it play out? ...
6 Best Practices For Increasing Security In AWS In A Zero Trust World

6 Best Practices For Increasing Security In AWS In A Zero Trust World

AWS Security Best Practices Enterprises are rapidly accelerating the pace at which they’re moving workloads to Amazon Web Services (AWS) ...
Digital Identity Trends – Previewing The Year Ahead

Digital Identity Trends – Previewing The Year Ahead

Digital Identity Trends The lack of security of the Internet of Things captured public attention this year as massive distributed ...
Bryan Doerr

Cyber-Threats and the Need for Secure Industrial Control Systems

Secure Industrial Control Systems (ICS) Industrial Control Systems (ICS) tend to be “out of sight, out of mind.” These systems ...

PARNTER LEARNING

$1,499.00Enroll Now

Cyber Security Expert Master's Program

Cyber Security Expert Master’s Program

The course will teach you: Advanced hacking concepts that can help you manage information security better. Architectures of frame cloud data storage and security strategies. You will learn how to use them to find and analyze risks. How to install, ...

$2,899.00Enroll Now

CEH (v10) – Certified Ethical Hacker Training Course

CEH (v10) – Certified Ethical Hacker Training Course

The course will help you: To understand the tactics and methodologies that hackers use to attack and penetrate any network. Understand honeypots, wireless hacking, firewall, and IDS. Become an expert in the hacking concepts, including smartphone hacking, writing virus codes, ...