Operations // Identity & Access Management
12:40 PM
Connect Directly

The Fuzzy Future Of Identity Management

Mobile, cloud, and BYOD blur the lines between work and home, forcing IT to envision a new identity and access management strategy.

Download this InformationWeek December 2013 special issue on identity and access management, distributed in an all-digital format (registration required).

The traditional worker bee comes into the office, logs in to a dedicated computer via Microsoft Active Directory credentials, and gets access to local applications and data shares needed to conduct daily activities. Simple, familiar, controlled -- and totally out of date for companies dealing with mobile devices, cloud computing, BYOD, and the blurring line between work and home, business and personal.

As the use of mobile and cloud computing booms, we're outgrowing our trusty old technology for identity and access management. But our future vision -- to know a person's identity across all the multiple devices, cloud services, and roles he has -- isn't possible with today's still-emerging technology. This causes lots of confusion as vendors vie to be the next great thing and IT tries to determine where to place bets.

As emerging cloud and mobile technologies settle out over the next few years, we in IT must maintain control by buying into transitional technologies, and also staking out and enforcing sometimes-unpopular policies. Employees don't like passcodes on phones, or giving up their personal Dropbox storage for an enterprise option, or feeling like their company might erase personal information from a device, but adopting new technology comes at a cost. Balancing the benefits with the costs is the art of information technology.

If you're not assessing the impact that increased use of mobile devices, bring-your-own-device initiatives, cloud storage, and cloud apps are having on your identity and access management strategy, then you're falling behind. Here are some important places to start.

Two-factor technology with cloud
As we move away from the model of employees accessing on-premises software systems using only company devices and networks, we also increase our exposure to certain threats. Now, instead of needing to get onto the corporate network with an approved device to access SharePoint files, we could potentially connect to Box from any device and simply provide a user name and password. The upside of the cloud option is easier access to important data, but the downside is that now only a user name and password combination stands between an attacker and company information. Not that we would ever accuse you or your colleagues of creating weak passwords, but we need something better.

Two-factor technologies aim to supplement poor or lost passwords by introducing a second component to the identity process. RSA and Entrust are the well-known old guard with millions of deployments, and the two-factor options range from tokens and smart cards to phone callbacks and SMS messages. Most of these technologies convey one-time passwords (OTPs) that are good for a period of time once you've made an authentication request to a system such as a Web server, application, or VPN endpoint.

OTP has been around for a long time and is better than just a password, but it's susceptible to man-in-the-middle attacks and DNS poisoning, such as when an attacker captures the OTP when someone unknowingly inputs it into a fake form. And it often relies on having an extra thing, such as a token or smart card.

One of the most exciting two-factor technologies we've seen that alleviates OTP weaknesses is Cyphercor's LoginTC. Say a salesperson out on the road is accessing Salesforce.com at a coffee shop. If using LoginTC, she enters her primary credentials on the site, and a message pops up on her phone asking "yes or no" if the access is legitimate. She answers yes, enters a passcode on her phone that unlocks a local token, and a message goes back to grant access.

LoginTC has two big advantages over OTP. First, Salesforce doesn't need personally identifiable information such as a phone number because tokenized challenges travel over the certificate-based Android, Apple, and BlackBerry push notification networks. Eliminating stored personal information simplifies regulatory compliance. Second, there are no vulnerable OTP codes being transmitted through insecure channels such as SMS or via automated phone calls or via cycling hardware tokens that are then entered into some remote web interface form that might or might not be legitimate. And there's a third factor: It uses the smartphone that salespeople already carry. Simplicity like this is key to getting employee adoption.

Richard Dreger co-wrote this story. He is co-founder of WaveGard, a Washington, D.C.-based professional services firm focused on providing expert-level risk intelligence, data protection, and smart mobility solutions to its clients. Follow him on Twitter: @wavegard.

To read the rest of this story,
download the InformationWeek December 2013 special issue on identity and access management, distributed in an all-digital format (registration required).

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
1/2/2014 | 6:49:16 AM
Solution is already present
"the downside is that now only a user name and password combination stands between an attacker and company information" - If a Single Sign-On system is integrated with Identity & Access Management system then employees don't even need to know the login credentials of any cloud service which enusres that employees won't lose the login credentials and only the administrator has the complete control of granting and revoking access.

Two factor authentication mostly suffices and increases the security of any system however there is always an option of integrating multi-factor authentication without hampering the user experience. For example, we at SmartSignin has added an image based authentication which protects against phishing attacks as well. It is not uncommon and is used by other companies like Quora.

However, the serious concern comes when the companies do not follow a good key management practice. Most companies stores the encryption keys on the server itself which is a serious threat if a hacker breaches the server (becoming very common these days).

So I would disagree that Identity & Access Management domain has a fuzzy future. It is going to be a huge market in the near future but the underlying concern will always be about the security of the system itself.
User Rank: Strategist
12/10/2013 | 6:49:38 PM
Stand firm
There's some very concrete advice here: you're going to have to enforce passwords on mobile devices, even though employees don't like them. No password protection, no BYOD. 
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio