Attacks/Breaches
3/7/2014
01:40 PM
Garret Grajek
Garret Grajek
Commentary
Connect Directly
LinkedIn
Google+
RSS
E-Mail
50%
50%

The Case For Browser-Based Access Controls

Is "browser-ized" security a better defense against hackers than traditional methods? Check out these two examples.

It’s apparent that network access is a hacker’s preferred point of attack. Just look at recent hacks, and to others as far back as the 2011 RSA breach. You'll see that the complexities and nuances of each network deployment simply encourage hackers. In fact, improper network segmentation is believed to be one of the primary factors in the Target HVAC breach.

Should we be giving network access to all these users? Of course not.  

Since the advent of browser-based information sharing, the need to allow full network access has incrementally decreased every year. Full network connectivity to various administrators, workers, and contractors is not only unnecessary today, it is downright dangerous.  

Security-wise, there is much that can be delivered today via the prism of an app, including browser-based apps. Take, for example, Google, which is doing a pretty good job with Google Apps teaching the world that a browser can accomplish a lot more than just sending emails and sharing pictures of cats.

Think about it. When was the last time a bank gave you network access to retrieve information on your bank account? What is standard practice to secure enterprise data in banking today is to “browser-ize” it by:

  • Hardening the web server
  • Conducting code scans
  • Filtering for known L7 attacks (cross-site scripting, etc.)
  • Securing the credential collection forms
  • Applying two-factor access controls

Once the enterprise data is put behind a quantifiable prism (which is the functionality that browsers perform), we can discern what information is being delivered to the user, such as which data stores the app is allowed to see, the roles, permissions, and authorization the app is allowed to see, and the security mechanisms the user should accomplish to achieve access.

Case in point: healthcare
Recently I was working on a project where foreign contractors were initially granted network access to manage the final leg of healthcare data processing. The enterprise auditors came in and flagged the network access as a violation of Personal Healthcare Information (PHI) access regulations. The solution? We created a web form that allowed offshore contractors to view the data they were allowed to see, and then submit an approval in accordance to the guidelines set forth by the enterprise. Most importantly, these contractors were granted no network access and thus had no visibility to the full set of PHI data.

In this case, once access was given to the user, modern L7 (web session) methods could be utilized to automate the authentication process via other web-based resources. For example, the SSO that provides information from one resource to the next can be intelligently conducted with access controls, including re-checking of group membership and re-verification of authorization. Mechanisms such as re-authentication with second factor on a timed basis, or step-up authentication for more access to the portal can also be inserted along with device registration and device inspection.

Mobile apps can also foil hackers
Mobile apps can serve the same functionality as the browser-based app, effectively quantifying both the user access and the data access in a single, functional prism of view. The mobile browser app can have similar control mechanisms, including device registration, two-factor, and host-inspection analytics. Additional mobile centric authentication can also be used, such as PUSH technology and Smart Card/NFC identification.

By restricting access to a web or mobile app or a set of web/mobile apps via a portal, enterprises can itemize and restrict:

  • Which users (or groups) get access
  • What type of authentication is required
  • What resources to which the users can have access
  • What data these resources are accessing

What’s more --  all of this access is logged, with access controls pre-determined and approved by the security, infrastructure, and yes, the network team.

Garret Grajek is a CISSP-certified security engineer with more than 20 years of experience in the information security and authentication space. As Chief Technical Officer and Chief Operating Officer for SecureAuth Corp., Garret is responsible for the company's identity ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
anon2505142574
50%
50%
anon2505142574,
User Rank: Apprentice
3/14/2014 | 10:27:47 AM
Browser Based Contrrols
It's a lot easier to insure a form-collection page/mobile app is secure - than to insure that proper network access controls are implemented across all sector  (Wifi, Lan, remote access, etc) of your network. 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
3/13/2014 | 12:19:27 PM
Interesting example form healthcare
Garret, I'm curious to know how common is the strategy you described where offshore contractors were able to view data via a web form with no actual network access. 

 
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0607
Published: 2014-07-24
Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.

CVE-2014-1419
Published: 2014-07-24
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.

CVE-2014-2360
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.

CVE-2014-2361
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.

CVE-2014-2362
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.