Attacks/Breaches
3/7/2014
01:40 PM
Garret Grajek
Garret Grajek
Commentary
Connect Directly
LinkedIn
Google+
RSS
E-Mail
50%
50%

The Case For Browser-Based Access Controls

Is "browser-ized" security a better defense against hackers than traditional methods? Check out these two examples.

It’s apparent that network access is a hacker’s preferred point of attack. Just look at recent hacks, and to others as far back as the 2011 RSA breach. You'll see that the complexities and nuances of each network deployment simply encourage hackers. In fact, improper network segmentation is believed to be one of the primary factors in the Target HVAC breach.

Should we be giving network access to all these users? Of course not.  

Since the advent of browser-based information sharing, the need to allow full network access has incrementally decreased every year. Full network connectivity to various administrators, workers, and contractors is not only unnecessary today, it is downright dangerous.  

Security-wise, there is much that can be delivered today via the prism of an app, including browser-based apps. Take, for example, Google, which is doing a pretty good job with Google Apps teaching the world that a browser can accomplish a lot more than just sending emails and sharing pictures of cats.

Think about it. When was the last time a bank gave you network access to retrieve information on your bank account? What is standard practice to secure enterprise data in banking today is to “browser-ize” it by:

  • Hardening the web server
  • Conducting code scans
  • Filtering for known L7 attacks (cross-site scripting, etc.)
  • Securing the credential collection forms
  • Applying two-factor access controls

Once the enterprise data is put behind a quantifiable prism (which is the functionality that browsers perform), we can discern what information is being delivered to the user, such as which data stores the app is allowed to see, the roles, permissions, and authorization the app is allowed to see, and the security mechanisms the user should accomplish to achieve access.

Case in point: healthcare
Recently I was working on a project where foreign contractors were initially granted network access to manage the final leg of healthcare data processing. The enterprise auditors came in and flagged the network access as a violation of Personal Healthcare Information (PHI) access regulations. The solution? We created a web form that allowed offshore contractors to view the data they were allowed to see, and then submit an approval in accordance to the guidelines set forth by the enterprise. Most importantly, these contractors were granted no network access and thus had no visibility to the full set of PHI data.

In this case, once access was given to the user, modern L7 (web session) methods could be utilized to automate the authentication process via other web-based resources. For example, the SSO that provides information from one resource to the next can be intelligently conducted with access controls, including re-checking of group membership and re-verification of authorization. Mechanisms such as re-authentication with second factor on a timed basis, or step-up authentication for more access to the portal can also be inserted along with device registration and device inspection.

Mobile apps can also foil hackers
Mobile apps can serve the same functionality as the browser-based app, effectively quantifying both the user access and the data access in a single, functional prism of view. The mobile browser app can have similar control mechanisms, including device registration, two-factor, and host-inspection analytics. Additional mobile centric authentication can also be used, such as PUSH technology and Smart Card/NFC identification.

By restricting access to a web or mobile app or a set of web/mobile apps via a portal, enterprises can itemize and restrict:

  • Which users (or groups) get access
  • What type of authentication is required
  • What resources to which the users can have access
  • What data these resources are accessing

What’s more --  all of this access is logged, with access controls pre-determined and approved by the security, infrastructure, and yes, the network team.

Garret Grajek is a CISSP-certified security engineer with more than 20 years of experience in the information security and authentication space. As Chief Technical Officer and Chief Operating Officer for SecureAuth Corp., Garret is responsible for the company's identity ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
3/13/2014 | 12:19:27 PM
Interesting example form healthcare
Garret, I'm curious to know how common is the strategy you described where offshore contractors were able to view data via a web form with no actual network access. 

 
anon2505142574
50%
50%
anon2505142574,
User Rank: Apprentice
3/14/2014 | 10:27:47 AM
Browser Based Contrrols
It's a lot easier to insure a form-collection page/mobile app is secure - than to insure that proper network access controls are implemented across all sector  (Wifi, Lan, remote access, etc) of your network. 
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4594
Published: 2014-10-25
The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment.

CVE-2014-0476
Published: 2014-10-25
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.

CVE-2014-1927
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928....

CVE-2014-1928
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulner...

CVE-2014-1929
Published: 2014-10-25
python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.