Security Basics: Multi-Factor Authentication
This post is one in a series of blog posts on the fundamentals of an information security program. You can see the complete list of posts in this series here.
Weak passwords, stolen passwords, cracked passwords, guessed passwords -- passwords figure in some way in a large share of breaches. So what is the best way to make sure that your passwords don't lead to a breach?
The answer is: stop relying on passwords.
Passwords are a technology that changed very little in the past several decades, and they are simply not a sufficiently secure mechanism for establishing identity for accessing an information system (authentication). This may be illustrated in many ways:
The fundamental problem with passwords is that they are static, not changing over a relatively long period of time. Whether you require password changes annually or quarterly or weekly, the password remains in effect more than long enough for an attacker to capture it and re-use it in an attack. The most common, and generally most flexible and cost-effective, solution is two-factor (or multi-factor) authentication. This generally involves the use of a cryptographically-generated passcode instead of or together with the user's password (or PIN). The code is different every time, making authentication using a stolen password or PIN virtually impossible. The use of the one-time codes also generally means passwords change essentially every time you log in, allowing organizations to relax or eliminate the requirement for users to change passwords on a regular basis.
In the past decade, this technology has become more mature and is now offered by many competing companies, which has driven cost down greatly. Most vendors that offer two-factor authentication provide the ability to generate or receive one-time passcodes on a mobile device, eliminating the need to issue separate devices. Some services use login confirmation on a mobile device instead of, or as an alternative to, a one-time passcode. Perhaps most importantly, most of these solutions are very flexible, making it possible to implement this technology within almost any network architecture or application.
Most webmail systems (e.g. Gmail, Hotmail), social network (e.g. Twitter, Facebook), and banks provide the option of multi-factor authentication to their users. Is your organizational information more critical than your employees' Facebook data? If it is, you should consider implementing the same type of security option they have available on Facebook.
Implementing two-factor security can involve some complexity, and simply rolling it out for all users for all login situation is not always the right move. Some more limited, but still highly-effective, measures to consider include:
More Reading on this topic:
https://www.securingthehuman.org/newsletters/ouch/issues/OUCH-201211_en.pdf
http://www.csoonline.com/article/2931820/data-breach/after-breaches-higher-ed-schools-adopt-two-factor-authentication.html#tk.rss_news
https://aragonresearch.com/two-factor-autnentication-a-must-have-for-enterprises/
http://www.wired.com/2013/04/five-myths-of-two-factor-authentication-and-the-reality/
The answer is: stop relying on passwords.
Passwords are a technology that changed very little in the past several decades, and they are simply not a sufficiently secure mechanism for establishing identity for accessing an information system (authentication). This may be illustrated in many ways:
- Verizon's 2015 Data Breach Investigations Report says that 95% of web application compromises involve the use of stolen credentials.
- Lack of authentication security beyond username and password was cited as a key factor in the OPM breach of 2015.
The fundamental problem with passwords is that they are static, not changing over a relatively long period of time. Whether you require password changes annually or quarterly or weekly, the password remains in effect more than long enough for an attacker to capture it and re-use it in an attack. The most common, and generally most flexible and cost-effective, solution is two-factor (or multi-factor) authentication. This generally involves the use of a cryptographically-generated passcode instead of or together with the user's password (or PIN). The code is different every time, making authentication using a stolen password or PIN virtually impossible. The use of the one-time codes also generally means passwords change essentially every time you log in, allowing organizations to relax or eliminate the requirement for users to change passwords on a regular basis.
In the past decade, this technology has become more mature and is now offered by many competing companies, which has driven cost down greatly. Most vendors that offer two-factor authentication provide the ability to generate or receive one-time passcodes on a mobile device, eliminating the need to issue separate devices. Some services use login confirmation on a mobile device instead of, or as an alternative to, a one-time passcode. Perhaps most importantly, most of these solutions are very flexible, making it possible to implement this technology within almost any network architecture or application.
Most webmail systems (e.g. Gmail, Hotmail), social network (e.g. Twitter, Facebook), and banks provide the option of multi-factor authentication to their users. Is your organizational information more critical than your employees' Facebook data? If it is, you should consider implementing the same type of security option they have available on Facebook.
Implementing two-factor security can involve some complexity, and simply rolling it out for all users for all login situation is not always the right move. Some more limited, but still highly-effective, measures to consider include:
- Implementing two-factor authentication as a requirement for all administrative or privileged accounts.
- Implementing two-factor authentication for all remote-access logins.
- Implementing two-factor authentication for key applications or databases.
More Reading on this topic:
https://www.securingthehuman.org/newsletters/ouch/issues/OUCH-201211_en.pdf
http://www.csoonline.com/article/2931820/data-breach/after-breaches-higher-ed-schools-adopt-two-factor-authentication.html#tk.rss_news
https://aragonresearch.com/two-factor-autnentication-a-must-have-for-enterprises/
http://www.wired.com/2013/04/five-myths-of-two-factor-authentication-and-the-reality/
Comments
Post a Comment