Operations //

Identity & Access Management

12/10/2013
12:40 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

The Fuzzy Future Of Identity Management

Mobile, cloud, and BYOD blur the lines between work and home, forcing IT to envision a new identity and access management strategy.

Download this InformationWeek December 2013 special issue on identity and access management, distributed in an all-digital format (registration required).

The traditional worker bee comes into the office, logs in to a dedicated computer via Microsoft Active Directory credentials, and gets access to local applications and data shares needed to conduct daily activities. Simple, familiar, controlled -- and totally out of date for companies dealing with mobile devices, cloud computing, BYOD, and the blurring line between work and home, business and personal.

As the use of mobile and cloud computing booms, we're outgrowing our trusty old technology for identity and access management. But our future vision -- to know a person's identity across all the multiple devices, cloud services, and roles he has -- isn't possible with today's still-emerging technology. This causes lots of confusion as vendors vie to be the next great thing and IT tries to determine where to place bets.

As emerging cloud and mobile technologies settle out over the next few years, we in IT must maintain control by buying into transitional technologies, and also staking out and enforcing sometimes-unpopular policies. Employees don't like passcodes on phones, or giving up their personal Dropbox storage for an enterprise option, or feeling like their company might erase personal information from a device, but adopting new technology comes at a cost. Balancing the benefits with the costs is the art of information technology.

If you're not assessing the impact that increased use of mobile devices, bring-your-own-device initiatives, cloud storage, and cloud apps are having on your identity and access management strategy, then you're falling behind. Here are some important places to start.

Two-factor technology with cloud
As we move away from the model of employees accessing on-premises software systems using only company devices and networks, we also increase our exposure to certain threats. Now, instead of needing to get onto the corporate network with an approved device to access SharePoint files, we could potentially connect to Box from any device and simply provide a user name and password. The upside of the cloud option is easier access to important data, but the downside is that now only a user name and password combination stands between an attacker and company information. Not that we would ever accuse you or your colleagues of creating weak passwords, but we need something better.

Two-factor technologies aim to supplement poor or lost passwords by introducing a second component to the identity process. RSA and Entrust are the well-known old guard with millions of deployments, and the two-factor options range from tokens and smart cards to phone callbacks and SMS messages. Most of these technologies convey one-time passwords (OTPs) that are good for a period of time once you've made an authentication request to a system such as a Web server, application, or VPN endpoint.

OTP has been around for a long time and is better than just a password, but it's susceptible to man-in-the-middle attacks and DNS poisoning, such as when an attacker captures the OTP when someone unknowingly inputs it into a fake form. And it often relies on having an extra thing, such as a token or smart card.

One of the most exciting two-factor technologies we've seen that alleviates OTP weaknesses is Cyphercor's LoginTC. Say a salesperson out on the road is accessing Salesforce.com at a coffee shop. If using LoginTC, she enters her primary credentials on the site, and a message pops up on her phone asking "yes or no" if the access is legitimate. She answers yes, enters a passcode on her phone that unlocks a local token, and a message goes back to grant access.

LoginTC has two big advantages over OTP. First, Salesforce doesn't need personally identifiable information such as a phone number because tokenized challenges travel over the certificate-based Android, Apple, and BlackBerry push notification networks. Eliminating stored personal information simplifies regulatory compliance. Second, there are no vulnerable OTP codes being transmitted through insecure channels such as SMS or via automated phone calls or via cycling hardware tokens that are then entered into some remote web interface form that might or might not be legitimate. And there's a third factor: It uses the smartphone that salespeople already carry. Simplicity like this is key to getting employee adoption.

Richard Dreger co-wrote this story. He is co-founder of WaveGard, a Washington, D.C.-based professional services firm focused on providing expert-level risk intelligence, data protection, and smart mobility solutions to its clients. Follow him on Twitter: @wavegard.

To read the rest of this story,
download the InformationWeek December 2013 special issue on identity and access management, distributed in an all-digital format (registration required).

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
pallavkaushish
50%
50%
pallavkaushish,
User Rank: Apprentice
1/2/2014 | 6:49:16 AM
Solution is already present
"the downside is that now only a user name and password combination stands between an attacker and company information" - If a Single Sign-On system is integrated with Identity & Access Management system then employees don't even need to know the login credentials of any cloud service which enusres that employees won't lose the login credentials and only the administrator has the complete control of granting and revoking access.

Two factor authentication mostly suffices and increases the security of any system however there is always an option of integrating multi-factor authentication without hampering the user experience. For example, we at SmartSignin has added an image based authentication which protects against phishing attacks as well. It is not uncommon and is used by other companies like Quora.

However, the serious concern comes when the companies do not follow a good key management practice. Most companies stores the encryption keys on the server itself which is a serious threat if a hacker breaches the server (becoming very common these days).

So I would disagree that Identity & Access Management domain has a fuzzy future. It is going to be a huge market in the near future but the underlying concern will always be about the security of the system itself.
ChrisMurphy
50%
50%
ChrisMurphy,
User Rank: Strategist
12/10/2013 | 6:49:38 PM
Stand firm
There's some very concrete advice here: you're going to have to enforce passwords on mobile devices, even though employees don't like them. No password protection, no BYOD. 
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-13435
PUBLISHED: 2018-08-16
** DISPUTED ** An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method to disable passcode authentication. NOTE: the vendor indicates that this is not an attack of interest w...
CVE-2018-13446
PUBLISHED: 2018-08-16
** DISPUTED ** An issue was discovered in the LINE jp.naver.line application 8.8.1 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. ...
CVE-2018-14567
PUBLISHED: 2018-08-16
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
CVE-2018-15122
PUBLISHED: 2018-08-16
An issue found in Progress Telerik JustAssembly through 2018.1.323.2 and JustDecompile through 2018.2.605.0 makes it possible to execute code by decompiling a compiled .NET object (such as DLL or EXE) with an embedded resource file by clicking on the resource.
CVE-2018-11509
PUBLISHED: 2018-08-16
ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.