Operations //

Identity & Access Management

12/10/2013
12:40 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

The Fuzzy Future Of Identity Management

Mobile, cloud, and BYOD blur the lines between work and home, forcing IT to envision a new identity and access management strategy.

Download this InformationWeek December 2013 special issue on identity and access management, distributed in an all-digital format (registration required).

The traditional worker bee comes into the office, logs in to a dedicated computer via Microsoft Active Directory credentials, and gets access to local applications and data shares needed to conduct daily activities. Simple, familiar, controlled -- and totally out of date for companies dealing with mobile devices, cloud computing, BYOD, and the blurring line between work and home, business and personal.

As the use of mobile and cloud computing booms, we're outgrowing our trusty old technology for identity and access management. But our future vision -- to know a person's identity across all the multiple devices, cloud services, and roles he has -- isn't possible with today's still-emerging technology. This causes lots of confusion as vendors vie to be the next great thing and IT tries to determine where to place bets.

As emerging cloud and mobile technologies settle out over the next few years, we in IT must maintain control by buying into transitional technologies, and also staking out and enforcing sometimes-unpopular policies. Employees don't like passcodes on phones, or giving up their personal Dropbox storage for an enterprise option, or feeling like their company might erase personal information from a device, but adopting new technology comes at a cost. Balancing the benefits with the costs is the art of information technology.

If you're not assessing the impact that increased use of mobile devices, bring-your-own-device initiatives, cloud storage, and cloud apps are having on your identity and access management strategy, then you're falling behind. Here are some important places to start.

Two-factor technology with cloud
As we move away from the model of employees accessing on-premises software systems using only company devices and networks, we also increase our exposure to certain threats. Now, instead of needing to get onto the corporate network with an approved device to access SharePoint files, we could potentially connect to Box from any device and simply provide a user name and password. The upside of the cloud option is easier access to important data, but the downside is that now only a user name and password combination stands between an attacker and company information. Not that we would ever accuse you or your colleagues of creating weak passwords, but we need something better.

Two-factor technologies aim to supplement poor or lost passwords by introducing a second component to the identity process. RSA and Entrust are the well-known old guard with millions of deployments, and the two-factor options range from tokens and smart cards to phone callbacks and SMS messages. Most of these technologies convey one-time passwords (OTPs) that are good for a period of time once you've made an authentication request to a system such as a Web server, application, or VPN endpoint.

OTP has been around for a long time and is better than just a password, but it's susceptible to man-in-the-middle attacks and DNS poisoning, such as when an attacker captures the OTP when someone unknowingly inputs it into a fake form. And it often relies on having an extra thing, such as a token or smart card.

One of the most exciting two-factor technologies we've seen that alleviates OTP weaknesses is Cyphercor's LoginTC. Say a salesperson out on the road is accessing Salesforce.com at a coffee shop. If using LoginTC, she enters her primary credentials on the site, and a message pops up on her phone asking "yes or no" if the access is legitimate. She answers yes, enters a passcode on her phone that unlocks a local token, and a message goes back to grant access.

LoginTC has two big advantages over OTP. First, Salesforce doesn't need personally identifiable information such as a phone number because tokenized challenges travel over the certificate-based Android, Apple, and BlackBerry push notification networks. Eliminating stored personal information simplifies regulatory compliance. Second, there are no vulnerable OTP codes being transmitted through insecure channels such as SMS or via automated phone calls or via cycling hardware tokens that are then entered into some remote web interface form that might or might not be legitimate. And there's a third factor: It uses the smartphone that salespeople already carry. Simplicity like this is key to getting employee adoption.

Richard Dreger co-wrote this story. He is co-founder of WaveGard, a Washington, D.C.-based professional services firm focused on providing expert-level risk intelligence, data protection, and smart mobility solutions to its clients. Follow him on Twitter: @wavegard.

To read the rest of this story,
download the InformationWeek December 2013 special issue on identity and access management, distributed in an all-digital format (registration required).

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
pallavkaushish
50%
50%
pallavkaushish,
User Rank: Apprentice
1/2/2014 | 6:49:16 AM
Solution is already present
"the downside is that now only a user name and password combination stands between an attacker and company information" - If a Single Sign-On system is integrated with Identity & Access Management system then employees don't even need to know the login credentials of any cloud service which enusres that employees won't lose the login credentials and only the administrator has the complete control of granting and revoking access.

Two factor authentication mostly suffices and increases the security of any system however there is always an option of integrating multi-factor authentication without hampering the user experience. For example, we at SmartSignin has added an image based authentication which protects against phishing attacks as well. It is not uncommon and is used by other companies like Quora.

However, the serious concern comes when the companies do not follow a good key management practice. Most companies stores the encryption keys on the server itself which is a serious threat if a hacker breaches the server (becoming very common these days).

So I would disagree that Identity & Access Management domain has a fuzzy future. It is going to be a huge market in the near future but the underlying concern will always be about the security of the system itself.
ChrisMurphy
50%
50%
ChrisMurphy,
User Rank: Strategist
12/10/2013 | 6:49:38 PM
Stand firm
There's some very concrete advice here: you're going to have to enforce passwords on mobile devices, even though employees don't like them. No password protection, no BYOD. 
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11378
PUBLISHED: 2019-04-20
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
CVE-2019-11372
PUBLISHED: 2019-04-20
An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11373
PUBLISHED: 2019-04-20
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11374
PUBLISHED: 2019-04-20
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
CVE-2019-11375
PUBLISHED: 2019-04-20
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.