Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

1/18/2012
08:48 PM
Don Bailey
Don Bailey
Commentary
Connect Directly
Twitter
RSS
E-Mail
50%
50%

I Left My Data In El Segundo

Data is the new bit of lost clothing you left behind on that road trip -- and two-factor authentication VPN is the way to go mobile

If you know me, then you know that travel is a major part of my life. I live out of a suitcase for a third of the year, bouncing from conference to conference and city to city. People typically acquire quite a bit while traveling: memories, visa stamps, exotic bank notes, and sometimes a wicked bird flu. But at the end of the day, it's not about what you come home with -- it's what you leave behind. Unless you're Chris McNab or Nick DePetrillo rocking the penthouse suite, you're probably like me and think you're mainly leaving behind your hard-earned cash. But for all of us, we're leaving behind much more.

Data is the new lost piece of clothing. Instead of obsessing over a lost sweater, sock, or t-shirt, I feel like I'm constantly wondering what interesting trail of bits I've left behind me as I move. On the road, our smartphones constantly remind us that we're attached to more than just beaches and sunsets. They remind us with emails, calendar events, text messages, and a myriad of other attention-hogging tools that never let us forget just how important the smartphone is in our lives. Regardless, each status update, tweet, or ignored phone call is routed directly to us through a vast network that is complex, worldwide, and often less secure than we think.

As our packets traverse the global mobile network, we have to remember that others are indeed listening. While the romance of digital espionage was once fodder for television and movies, the modern-day reality is that it's everywhere. Government organizations want to enforce disabling encryption for security and safety reasons, kids and creeps poke at our browsers with Fire Sheep in cafes and airports, and even the occasional red-headed hacker crashes your phone's baseband out of boredom. Regardless of the means, motive, or likelihood of attack, the threat is real and there is a heck of a lot to lose.

Thankfully, we have options while traveling for both pleasure and work. And let's face it: There really is no longer a difference when you can take a conference call with a client at a Hindu shrine in Malaysia before prayer service. That's what makes technology so amazing! And with that amazing technology comes some simple steps that we can take to secure our important data and communications.

First of all, if you haven't checked out Duo Security or Google Auth, you need to. This is required reading, folks. Two-factor authentication is an absolute imperative. One of the most common vectors for network compromise in modern day is the virtual private network. The VPN allows access to all the enterprise's resources from thousands of miles away. Not only can someone listen in on my Malaysian conference call, but they could potentially steal my network login credentials and turn my vacation into a veritable information technology disaster. Two-factor authentication negates this attack vector by forcing the malicious party to crack more than a password. The attacker would also need your time-delimited token to successfully authenticate. Since mobile applications like Duo and Google Auth can be easily installed and run on the go, you always have easy access to your authentication credentials while minimizing potential impact of an attack.

Even if an attacker were to steal your phone, he would also need your password to log on, so even theft of the mobile device is a minimized threat to the enterprise.

What's even more imperative with new applications like these is that you no longer have to worry about a third party's compromise exposing your tokens. I think we all remember the lessons learned from a certain security giant's compromise in the recent past, don't we? We remember that time-based, one-time password algorithms are based on a seed, and that if the seed is compromised, your login token can be potentially derived and, of course, abused.

Well, with systems like Google Auth you manage your own seeds. While this means your enterprise must manage another piece of high security data, it's really the same as the enterprise managing passwords.

What's important is that first, as we saw with the RSA compromise, you might not get told right away when an important security resource you depend on has been breached. If you hold the seeds, however, you're no longer hoping that a black hole of security is telling you the truth. You have the ability to manage and monitor one of the most important pieces of personnel data you use, and if your enterprise security team is diligent, they are likely to detect a compromise, allowing you some time to react appropriately.

Second, a breach of a secure internal server housing critical VPN tokens is much more difficult to compromise if the attackers are likely to need those same VPN tokens in the first place. Two-factor auth? Just do it!

Most important? The next time you have to download an important document on your smartphone in a crowded airport in Mumbai, you'll feel far more comfortable knowing you've done so over a two-factor enabled VPN.

Especially since the brilliant guys that hang out at NullCon may be traveling to the same conference as you and are waiting at your flight's gate.

Don Bailey is director of research at iSEC Partners. Don A. Bailey is a pioneer in security for mobile technology, the Internet of Things, and embedded systems. He has a long history of ground-breaking research, protecting mobile users from worldwide tracking systems, securing automobiles from remote attack, and mitigating ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
soapwax
50%
50%
soapwax,
User Rank: Apprentice
2/16/2012 | 10:16:05 AM
re: I Left My Data In El Segundo
Do you do anything to protect CC's or personal info? What about internet access when you're out of the states. Do you mainly rely on local wireless, or do you have mobile internet access / SIM cards?
BWILSON000
50%
50%
BWILSON000,
User Rank: Apprentice
1/25/2012 | 5:20:16 AM
re: I Left My Data In El Segundo
I second that! -People should ALWAYS take advantage of two-factor authentication when it is available to them. -Although the extra step may seem like a hassle to some, it is so worth it in the long run. -Also, some people may not be aware that it isnGt just VPNs or Google that offer two-factor authentication. Many businesses, sites and financial institutions are making it available as an affordable opt-in option for customers. (Disclosure - I work for Symantec, and we provide a cloud-based two-factor authentication solution called Symantec VIP - please don't hit me).
Commentary
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
Edge-DRsplash-10-edge-articles
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
News
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-36394
PUBLISHED: 2021-06-22
pam_setquota.c in the pam_setquota module before 2020-05-29 for Linux-PAM allows local attackers to set their quota on an arbitrary filesystem, in certain situations where the attacker's home directory is a FUSE filesystem mounted under /home.
CVE-2021-32699
PUBLISHED: 2021-06-22
Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious user can consume more resources than intende...
CVE-2021-32700
PUBLISHED: 2021-06-22
Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up to alpha 3 have a potential for a supply chain attack via MiTM against users. Http connections did not make use of TLS and certificate checking was ignored. Th...
CVE-2021-32701
PUBLISHED: 2021-06-22
ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. When you make a request to an endpoint that requires the scope `foo` using an access token granted with that `foo` scope, introspection will be valid an...
CVE-2021-22382
PUBLISHED: 2021-06-22
Huawei LTE USB Dongle products have an improper permission assignment vulnerability. An attacker can locally access and log in to a PC to induce a user to install a specially crafted application. After successfully exploiting this vulnerability, the attacker can perform unauthenticated operations. A...