Operations //

Identity & Access Management

12/10/2013
12:40 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

The Fuzzy Future Of Identity Management

Mobile, cloud, and BYOD blur the lines between work and home, forcing IT to envision a new identity and access management strategy.

Download this InformationWeek December 2013 special issue on identity and access management, distributed in an all-digital format (registration required).

The traditional worker bee comes into the office, logs in to a dedicated computer via Microsoft Active Directory credentials, and gets access to local applications and data shares needed to conduct daily activities. Simple, familiar, controlled -- and totally out of date for companies dealing with mobile devices, cloud computing, BYOD, and the blurring line between work and home, business and personal.

As the use of mobile and cloud computing booms, we're outgrowing our trusty old technology for identity and access management. But our future vision -- to know a person's identity across all the multiple devices, cloud services, and roles he has -- isn't possible with today's still-emerging technology. This causes lots of confusion as vendors vie to be the next great thing and IT tries to determine where to place bets.

As emerging cloud and mobile technologies settle out over the next few years, we in IT must maintain control by buying into transitional technologies, and also staking out and enforcing sometimes-unpopular policies. Employees don't like passcodes on phones, or giving up their personal Dropbox storage for an enterprise option, or feeling like their company might erase personal information from a device, but adopting new technology comes at a cost. Balancing the benefits with the costs is the art of information technology.

If you're not assessing the impact that increased use of mobile devices, bring-your-own-device initiatives, cloud storage, and cloud apps are having on your identity and access management strategy, then you're falling behind. Here are some important places to start.

Two-factor technology with cloud
As we move away from the model of employees accessing on-premises software systems using only company devices and networks, we also increase our exposure to certain threats. Now, instead of needing to get onto the corporate network with an approved device to access SharePoint files, we could potentially connect to Box from any device and simply provide a user name and password. The upside of the cloud option is easier access to important data, but the downside is that now only a user name and password combination stands between an attacker and company information. Not that we would ever accuse you or your colleagues of creating weak passwords, but we need something better.

Two-factor technologies aim to supplement poor or lost passwords by introducing a second component to the identity process. RSA and Entrust are the well-known old guard with millions of deployments, and the two-factor options range from tokens and smart cards to phone callbacks and SMS messages. Most of these technologies convey one-time passwords (OTPs) that are good for a period of time once you've made an authentication request to a system such as a Web server, application, or VPN endpoint.

OTP has been around for a long time and is better than just a password, but it's susceptible to man-in-the-middle attacks and DNS poisoning, such as when an attacker captures the OTP when someone unknowingly inputs it into a fake form. And it often relies on having an extra thing, such as a token or smart card.

One of the most exciting two-factor technologies we've seen that alleviates OTP weaknesses is Cyphercor's LoginTC. Say a salesperson out on the road is accessing Salesforce.com at a coffee shop. If using LoginTC, she enters her primary credentials on the site, and a message pops up on her phone asking "yes or no" if the access is legitimate. She answers yes, enters a passcode on her phone that unlocks a local token, and a message goes back to grant access.

LoginTC has two big advantages over OTP. First, Salesforce doesn't need personally identifiable information such as a phone number because tokenized challenges travel over the certificate-based Android, Apple, and BlackBerry push notification networks. Eliminating stored personal information simplifies regulatory compliance. Second, there are no vulnerable OTP codes being transmitted through insecure channels such as SMS or via automated phone calls or via cycling hardware tokens that are then entered into some remote web interface form that might or might not be legitimate. And there's a third factor: It uses the smartphone that salespeople already carry. Simplicity like this is key to getting employee adoption.

Richard Dreger co-wrote this story. He is co-founder of WaveGard, a Washington, D.C.-based professional services firm focused on providing expert-level risk intelligence, data protection, and smart mobility solutions to its clients. Follow him on Twitter: @wavegard.

To read the rest of this story,
download the InformationWeek December 2013 special issue on identity and access management, distributed in an all-digital format (registration required).

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
pallavkaushish
50%
50%
pallavkaushish,
User Rank: Apprentice
1/2/2014 | 6:49:16 AM
Solution is already present
"the downside is that now only a user name and password combination stands between an attacker and company information" - If a Single Sign-On system is integrated with Identity & Access Management system then employees don't even need to know the login credentials of any cloud service which enusres that employees won't lose the login credentials and only the administrator has the complete control of granting and revoking access.

Two factor authentication mostly suffices and increases the security of any system however there is always an option of integrating multi-factor authentication without hampering the user experience. For example, we at SmartSignin has added an image based authentication which protects against phishing attacks as well. It is not uncommon and is used by other companies like Quora.

However, the serious concern comes when the companies do not follow a good key management practice. Most companies stores the encryption keys on the server itself which is a serious threat if a hacker breaches the server (becoming very common these days).

So I would disagree that Identity & Access Management domain has a fuzzy future. It is going to be a huge market in the near future but the underlying concern will always be about the security of the system itself.
ChrisMurphy
50%
50%
ChrisMurphy,
User Rank: Strategist
12/10/2013 | 6:49:38 PM
Stand firm
There's some very concrete advice here: you're going to have to enforce passwords on mobile devices, even though employees don't like them. No password protection, no BYOD. 
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
Most Malware Arrives Via Email
Dark Reading Staff 10/11/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17534
PUBLISHED: 2018-10-15
Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. This allows attackers with physical access to execute arbitrary commands with root privileges.
CVE-2018-17980
PUBLISHED: 2018-10-15
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same directory as a .nxs file, as demonstrated by a scenario where the .nxs file and the DLL are in the current working directory, and the Trojan horse code is execute...
CVE-2018-18259
PUBLISHED: 2018-10-15
Stored XSS has been discovered in version 1.0.12 of the LUYA CMS software via /admin/api-cms-nav/create-page.
CVE-2018-18260
PUBLISHED: 2018-10-15
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false.
CVE-2018-17532
PUBLISHED: 2018-10-15
Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This allows remote attackers to execute arbitrary commands with root privileges.