Michael Mongold's Technology Security

The Case for Hybrid Identity-as-a-Service (IDaaS) Part II

The End User’s Dilemma

It is accepted now by business professionals and security practitioners alike, that identity theft and stolen credentials is a widely used vector for breaching organizations around the world. Passwords are still the most common form of credential used while also being the most abused method of authentication.

As organizations have required their users to provide higher and higher levels of password complexity with little or no uniformity between organizations, end users are required to track five, ten, twenty, or more login credentials. Best practices for password suggest at least eight characters, with uppercase, lowercase, numbers, and symbols utilized. It is also suggested that you changed the password at least every ninety days while not repeating the password again for at least four generations of passwords. Add in that you shouldn’t use birthdates, social security numbers, proper names, or really, any word from a dictionary and, oh yes, make sure that each site has a unique username and password so that if one is compromised, all of you identities will not be compromised. The situation, as presented like this, is untenable.

So the end user does what she must to do her job. Likely this means, either using one username and password for everything but then not every site has the same requirements. So that if she has a symbol as required by one site, but not allowed to use symbols by another site, she ends up being forced to remember a few variations and most likely just writes them down somewhere, either on her computer or on a piece of paper at her desk.

This defeats the purpose of implementing password security because if someone can walk over to her desk and acquire her passwords, non-repudiation and plausible deniability are thrown out the window. If a breach is traced back to her account, it can be difficult to show intent or complicity in the act of allowing the breach to occur.

Biometrics, OTP, and certificate-based authentication mechanisms are significantly more secure than passwords but all have struggled with supplanting passwords as the credential of choice for the vast majority of organizations and end users.

Come by PasswordBank to find out more or stay tuned until next week...

...Michael Mongold...

The Case for Hybrid Identity-as-a-Service

The Case for Hybrid Identity-as-a-Service (IDaaS) Part I

Hybrid Identity-as-a-Service (IDaaS) provides a clear path to reducing the dangers associated with cloud-adoption.

The world of the information security professional continues to become further complex as more of the services that were traditionally within the control of the information security team, are outsourced to external entities. Just a few years ago, a CISO (Chief Information Security Officer) was able to confidently assure his CIO/CFO/Legal Counsel that their organization was providing adequate levels of protection for the confidentiality, integrity, and availability of the sensitive data that they were tasked with securing, by simply inspecting the organization’s internal hardware and software solutions.

But as organizations are being pushed to adopt more flexible working environments that includes the consumerization of the users’ laptops and mobile devices (BYOD: Bring Your Own Device), those organizations are also faced with no longer having direct control over the security of the locations that the data is served from and the infrastructure used to deliver those services.

Information Security team’s are now tasked with vetting an external service provider to ensure they are up to the task of providing the same level of confidentiality, integrity, and availability that they once provided internally. Now, the Information Security Manager has a new layer of abstraction between their role and the role’s responsibilities while maintaining the same level of liability if something goes wrong. If the CISO had difficulty sleeping before, they are certain to be bleary-eyed now.

So if there are inherent risks in rushing these services into the cloud, why is the business pushing for them? There are many truly exceptional benefits of leveraging cloud providers for reducing CapEx costs, realizing fast ROIs, and amazing, almost unlimited, scalability. Unfortunately, the speed of business can, and often does, exceed the speed of security.

One area where the vacuum has been most largely felt is in the expanse of secure access and identity management.

The Problem. When a panel was asked at a recent security conference “How many web or cloud services their organization is using and how do they manage identities and authentication into them?” One panelist, the CIO of one of the largest cities in America, initially responded, “How do you define the cloud?” Upon further reflection, he stated that there were more than six services with no centralized identity management or authentication mechanism in their organization. The CISO for a state government agency responded similarly but with over 20 (potentially 50) services that are utilized with no centralized access or identity management.

This will probably not surprise most. Just ask any business about the cloud services they use and how they manage the identities and authentication into those environments. Over the past couple of years, adoption of cloud offerings have accelerated to provide businesses’ solutions that deliver needed services without direct payroll costs or management in an incredibly scalable manner. The justification for cloud adoption is becoming clearer to the business-side of the house as there is little or no spin-up time for the organization between the purchase of a solution and using it. So business have jumped ahead at the savings-potential the cloud market provides.

But the information security team is not the only ones trying to catch up. Even now organizations such as the PCI Standards Council are struggling to redefine what is considered “in scope” as the boundaries of past networks are dissolved in order to allow access to valuable data anytime/anywhere.

With the gap widening between the services that a cloud offering can provide and the solutions that can secure the access and identity management to those services, it is clear that organizations must educate themselves of the dangers that this vacuum presents even as compliance organizations work to provide standardized controls.

Stay tuned for Part II next week or drop on by www.passwordbank.com for an advance copy. :)