Operations // Identity & Access Management
2/4/2014
05:15 PM
Garret Grajek
Garret Grajek
Commentary
Connect Directly
LinkedIn
Google+
RSS
E-Mail

The Problem With Two-Factor Authentication

The failure of corporate security strategies to protect personal identity information from hackers resides more with system architecture than with authentication technology. Here's why.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 4   >   >>
humlik
50%
50%
humlik,
User Rank: Apprentice
2/13/2014 | 8:42:28 AM
The problem is the authentication technology itself, not the outside architecture
First - thanks for the article, it's always good to open painful topics. I absolutely agree with Andrew's comment. Garret Grajek excellently identified and formulated several Achilles heels of authentication, bud I disagree with the formulation that "The problem is not in authentication"- I would formulate the main idea in the opposite way: "The problem is the authentication technology itself, not the outside architecture!"

Garret in his article correctly observed one architectural misconception. He uncovered that the authentication technology is not just composed of "identity verification act".

Many of you (does not matter if you are customer or developer) may already have noticed that the rest of Devils's hoof is being silently moved onto your shoulders.

And that's wrong. The authentication technology must offer a compact and unbreakable solution for entire life-cycle of your "cybernetic" identity – identity creation, validation/verification, deletion, lost, expiration and much more including ID provisioning!

That's why the US is coming with the NSTIC (National Strategy for Trusted Identities in Cyberspace - http://www.nist.gov/nstic/), why the European Union is coming with the SSEDIC activity (European eID - http://www.eid-ssedic.eu/).

Maybe one interesting information is coming for EU region – the SSEDIC has been completing work on formulating visions of future eID. This work is coming from 3-year SSEDIC analysis of existing authentication technologies and issues. Main principles of that future vision are incorporated into new strategy called DII – Distributed Identity Infrastructure. The final text of recommendation will be released soon.

Welcome to the new Matrix ;)
aaronAshfield
50%
50%
aaronAshfield,
User Rank: Apprentice
2/12/2014 | 12:33:01 AM
Two-Factor Authentication is OBSOLETE
Two-factor authentication is an old concept that applies well to workstations, however, fails to protect data on mobile devices... A simple device left un-attended while open will compromise enterprise data. Presence-based real-time security offered by Secure Access Technologies provides breakthrough security and breakthrough user experience. www.SecureAccessTechnologies.com
WKash
50%
50%
WKash,
User Rank: Apprentice
2/10/2014 | 3:37:37 PM
NIST NSTICk
Garret, what's your take on the work being done at NIST and the National Strategy for Trusted Identities in Cyberspace  in coming up w/ better a better solution?
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
2/10/2014 | 8:51:13 AM
Re: Two factor is useful after the data breach
I second your point about user acceptance of 2FA. Speaking as typical end-user, I for one, would welcome any relief from the tyranny (and ineffectiveness) of passwords.

(PS Thanks for the disclosure of your relationship with the author's company!)
capsaicin
50%
50%
capsaicin,
User Rank: Apprentice
2/7/2014 | 5:35:40 PM
Re: Two factor is useful after the data breach
I think that is exactly one of the points the author makes. Any authentication mechanism can be breached, thus it is imperative that their are options and flexibility available to easily move to another methodology. We should all accept and expect that over time there will be a breach of a given method, be it the Toopher method, or the Telephony / SMS / Push methods that have gained a lot of traction. When that happens, it needs to be simple to switch to a new methodology very quickly (click of a mouse?) without having to completely recode / rip and replace technology.
RobertW152
100%
0%
RobertW152,
User Rank: Apprentice
2/7/2014 | 4:39:09 PM
Re: Two factor is useful after the data breach
I agree with you completely, and think that the #1 hurdle for 2FA, is acceptance by the end user. I think most organizations gamble that productivity is more important than security until a hack occurrs. If you give your end users a technology that balances Productivity & Security, then organizations will adopt 2FA for themselves and for other user groups like contactors, customers, Before it's too late. Disclosure: I work for SecureAuth, the author of this post's company.
IMjustinkern
100%
0%
IMjustinkern,
User Rank: Strategist
2/7/2014 | 3:59:05 PM
Re: Two factor is useful after the data breach
I know our folks and customers are big fans of Toopher. Lots of people using LastPass or KeePass (more on the former). I think two-factor authentication has a great place as part of a "defense in depth" approach, which starts with the data. That's what the hackers are going for, after all. 
GGRAJEK
100%
0%
GGRAJEK,
User Rank: Apprentice
2/7/2014 | 3:11:32 PM
Re: Duo Security
>  the security lies mainly with architecture from design perpsective instead of single piece of authentication technolog

Exactly.   I will be writing more about this.  If you want any more immediate readings, please go to:

http://blog.secureauth.com/cto

 
tstewart2k
100%
0%
tstewart2k,
User Rank: Apprentice
2/7/2014 | 3:11:13 PM
Re: Two factor is useful after the data breach
If someone stole your phone AND knew where you did business, they would also need your username and password, so that is more like 3 or 4 ppints of failure.  That is beside the point becuase you (person responsible for providing access to and protecting application(s) can add factors (1, 2, 3+...) and strength of those factors depending on the value of the data and the usability requirements.  By having the strong auth and SSO abstracted away form the guts of the app, there is flexibility to respond to threats and tweak auth methods in real without touching all the apps every time.  That is the beauty of what Garret is talking about.  It is a fundamentally better way in every way.  
GGRAJEK
100%
0%
GGRAJEK,
User Rank: Apprentice
2/7/2014 | 3:09:32 PM
Re: Great write up
Will do.   The Neiman Marcus, Living Social, Snapchat hacks have made us authentication guys "hip" again - and I thank InformationWeek for giving me the forum to write about what I love!
Page 1 / 4   >   >>
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3304
Published: 2014-10-30
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.

CVE-2013-7409
Published: 2014-10-30
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.

CVE-2014-3446
Published: 2014-10-30
SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.

CVE-2014-3584
Published: 2014-10-30
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

CVE-2014-3623
Published: 2014-10-30
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vect...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.