Attacks/Breaches
3/7/2014
01:40 PM
Garret Grajek
Garret Grajek
Commentary
Connect Directly
LinkedIn
Google+
RSS
E-Mail
50%
50%

The Case For Browser-Based Access Controls

Is "browser-ized" security a better defense against hackers than traditional methods? Check out these two examples.

It’s apparent that network access is a hacker’s preferred point of attack. Just look at recent hacks, and to others as far back as the 2011 RSA breach. You'll see that the complexities and nuances of each network deployment simply encourage hackers. In fact, improper network segmentation is believed to be one of the primary factors in the Target HVAC breach.

Should we be giving network access to all these users? Of course not.  

Since the advent of browser-based information sharing, the need to allow full network access has incrementally decreased every year. Full network connectivity to various administrators, workers, and contractors is not only unnecessary today, it is downright dangerous.  

Security-wise, there is much that can be delivered today via the prism of an app, including browser-based apps. Take, for example, Google, which is doing a pretty good job with Google Apps teaching the world that a browser can accomplish a lot more than just sending emails and sharing pictures of cats.

Think about it. When was the last time a bank gave you network access to retrieve information on your bank account? What is standard practice to secure enterprise data in banking today is to “browser-ize” it by:

  • Hardening the web server
  • Conducting code scans
  • Filtering for known L7 attacks (cross-site scripting, etc.)
  • Securing the credential collection forms
  • Applying two-factor access controls

Once the enterprise data is put behind a quantifiable prism (which is the functionality that browsers perform), we can discern what information is being delivered to the user, such as which data stores the app is allowed to see, the roles, permissions, and authorization the app is allowed to see, and the security mechanisms the user should accomplish to achieve access.

Case in point: healthcare
Recently I was working on a project where foreign contractors were initially granted network access to manage the final leg of healthcare data processing. The enterprise auditors came in and flagged the network access as a violation of Personal Healthcare Information (PHI) access regulations. The solution? We created a web form that allowed offshore contractors to view the data they were allowed to see, and then submit an approval in accordance to the guidelines set forth by the enterprise. Most importantly, these contractors were granted no network access and thus had no visibility to the full set of PHI data.

In this case, once access was given to the user, modern L7 (web session) methods could be utilized to automate the authentication process via other web-based resources. For example, the SSO that provides information from one resource to the next can be intelligently conducted with access controls, including re-checking of group membership and re-verification of authorization. Mechanisms such as re-authentication with second factor on a timed basis, or step-up authentication for more access to the portal can also be inserted along with device registration and device inspection.

Mobile apps can also foil hackers
Mobile apps can serve the same functionality as the browser-based app, effectively quantifying both the user access and the data access in a single, functional prism of view. The mobile browser app can have similar control mechanisms, including device registration, two-factor, and host-inspection analytics. Additional mobile centric authentication can also be used, such as PUSH technology and Smart Card/NFC identification.

By restricting access to a web or mobile app or a set of web/mobile apps via a portal, enterprises can itemize and restrict:

  • Which users (or groups) get access
  • What type of authentication is required
  • What resources to which the users can have access
  • What data these resources are accessing

What’s more --  all of this access is logged, with access controls pre-determined and approved by the security, infrastructure, and yes, the network team.

Garret Grajek is a CISSP-certified security engineer with more than 20 years of experience in the information security and authentication space. As Chief Technical Officer and Chief Operating Officer for SecureAuth Corp., Garret is responsible for the company's identity ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
3/13/2014 | 12:19:27 PM
Interesting example form healthcare
Garret, I'm curious to know how common is the strategy you described where offshore contractors were able to view data via a web form with no actual network access. 

 
anon2505142574
50%
50%
anon2505142574,
User Rank: Apprentice
3/14/2014 | 10:27:47 AM
Browser Based Contrrols
It's a lot easier to insure a form-collection page/mobile app is secure - than to insure that proper network access controls are implemented across all sector  (Wifi, Lan, remote access, etc) of your network. 
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-6093
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6196
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSp...

CVE-2014-7247
Published: 2014-11-25
Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?