We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byMelissa Adkins
Modified over 3 years ago
Authentication: the problem that will not go away Prof. Ravi Sandhu Chief Scientist Protecting Online Identity
© Copyright Ravi Sandhu 2008 Page 2 The State of Cyber Security We are in the midst of big change Nobody knows where we are headed Conventional wisdom on where we are headed is likely wrong
© Copyright Ravi Sandhu 2008 Page 3 Security Schools of Thought OLD THINK: We had it figured out. If the industry had only listened to us our computers and networks today would be secure. REALITY: Todays and tomorrows cyber systems and their security needs are fundamentally different from the timesharing era of the early 1970s.
© Copyright Ravi Sandhu 2008 Page 4 Change Drivers Stand-alone mainframes and mini-computers InternetEnterprise security Mutually suspicious security with split responsibility VandalsCriminals Few and standard services Many and new innovative services
© Copyright Ravi Sandhu 2008 Page 5 Authentication is fundamental to security is hard Authentication can enable single sign on (or reduced sign on) digital signatures Authentication Characterized
© Copyright Ravi Sandhu 2008 Page 6 Something you know Passwords, Personal facts Something you have Smart card, One-Time-Password generator, PC … Something you are Fingerprint, Iris, DNA, Voiceprint, … Multifactor = 2 or more of these Leap to 2-factor from 1-factor provides biggest gain 2 factors typically from different categories above Authentication Sliced
© Copyright Ravi Sandhu 2008 Page 7 Shared secrets versus public-private keys Shared secrets do not scale, especially across administrative domains Shared secrets do not facilitate single sign-on The holy grail of public key infrastructure continues to offer the best hope for scalability and single sign-on Mostly true BUT dont forget Kerberos, symmetric key single sign-on within an enterprise ATM network Authentication Sliced Differently: Take 1
© Copyright Ravi Sandhu 2008 Page 8 One-way authentication versus mutual authentication One-way authentication is the norm It is particularly susceptible to phishing One-time passwords are susceptible to MITM attacks due to lack of mutual authentication Authentication Sliced Differently: Take 2
© Copyright Ravi Sandhu 2008 Page 9 Two-factor (or multi-factor) Mutual authentication Strong Authentication
© Copyright Ravi Sandhu 2008 Page 10 Existing Authentication Methods & Threats Strong User Authentication Weak User Authentication Transaction Authentication
© Copyright Ravi Sandhu 2008 Page 11 Why Are These Security Measures Vulnerable? Authentication technologies are vulnerable to MITM Phishing 2.0 attacks when: They rely on weak, easily spoofable information They rely on shared secrets They use only one-way SSL security Vulnerable Authentication Technologies : IP Geo, Device Fingerprint, OTP Tokens, Scratch Cards, Grid Cards, Cookies, Text, and Pictures
© Copyright Ravi Sandhu 2008 Page 12 Man-in-the-Middle Attacks Are Happening A man-in-the-middle attack (MITM): attacker is able to read, insert and modify transactions between two parties without either party knowing that the link between them has been compromised. CitiBank Attack: July 10 th, 2006 Defeated OTP Tokens 35 MITM Sites in Russia Amazon Attack: January 3rd, 2007 Defeated Username/Password Bank of America: April 10th, 2007 Defeats Sitekey Cookie/Picture (Movie)Movie ABN AMRO: April 20 th, 2007 Defeats OTP Token
© Copyright Ravi Sandhu 2008 Page 13 The Citibank Attack Decrypted Phishing Links to fake CitiBusiness login page, hosted in Russia by Tufel-Club.ru and routed through botnet. Inputs and steals users credentials (including Token code) in real time at the actual CitiBusiness.com site Attacker changes transaction or executes a new transaction
© Copyright Ravi Sandhu 2008 Page 14 IP Spoofing Story IP Spoofing predicted in Bell Labs report st Generation firewalls deployed 1992 IP Spoofing attacks proliferate in the wild 1993 VPNs emerge late 1990s Vulnerability shifts to accessing end-point Network Admission Control 2000s
© Copyright Ravi Sandhu 2008 Page 15 Evolution of Phishing Phishing 1.0 Attack: Capture reusable passwords Defense: user education, cookies, pictures Phishing 2.0 Attack: MITM in the 1-way SSL channel, breaks OTPs Defense: 2-way SSL Phishing 3.0 Attack: Browser-based MITB client in front of 2-way SSL Defense: Transaction authentication outside browser Phishing 4.0 Attack: PC-based MIPC client in front of 2-way SSL Defense: Transaction authentication outside PC, PC hardening
© Copyright Ravi Sandhu 2008 Page 16 Sandhus Laws of Attackers 1.Attackers exist You will be attacked 2.Attackers have sharply escalating incentive Money, terrorism, warfare, espionage, sabotage, … 3.Attackers are lazy (follow path of least resistance) Attacks will escalate BUT no faster than necessary 4.Attackers are innovative (and stealthy) Eventually all feasible attacks will manifest 5.Attackers are copycats Known attacks will proliferate widely 6.Attackers have asymmetrical advantage Need one point of failure
© Copyright Ravi Sandhu 2008 Page 17 Sandhus Laws of Defenders 1.Defenses are necessary 2.Defenses have escalating scope 3.Defenses raise barriers for attackers 4.Defenses will require new barriers over time 5.Defenses with better barriers have value 6.Defenses will be breached
© Copyright Ravi Sandhu 2008 Page 18 Sandhus Laws of Users 1.Users exist and are necessary 2.Users have escalating exposure 3.Users are lazy and expect convenience 4.Users are innovative and will bypass inconvenient security 5.Users are the weakest link 6.Users expect to be protected
© Copyright Ravi Sandhu 2008 Page 19 Operational Principles A.Prepare for tomorrows attacks, not just yesterdays Good defenders strive to stay ahead of the curve, bad defenders forever lag B.Take care of tomorrows attacks before next years attacks Researchers will and should pursue defense against attacks that will manifest far in the future BUT these solutions will deploy only as attacks catch up C.Use future-proof barriers Defenders need a roadmap and need to make adjustments D.Its all about trade-offs Security, Convenience, Cost
Sandhus Laws of Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security University of Texas at San Antonio Chief.
1 Laws of Cyber Security Ravi Sandhu Executive Director and Endowed Professor September 2010
The Future: Evolution of the Technology Ravi Sandhu Chief Scientist TriCipher, Inc. Los Gatos, California Executive Director and Chaired Professor Institute.
1 Understanding Which New Threats Operators Can Expect To Face Within The Next Two To Five Years To Improve The On- Going Management Of Security Systems.
1 Rethinking Password Strategies Ravi Sandhu Chief Scientist
October 12th, 2004U.S. National Cybersecurity U.S. National Cybersecurity Understanding Internet Security William J. Perry Martin Casado Keith Coleman.
Institute for Cyber Security ASCAA Principles for Next- Generation Role-Based Access Control Ravi Sandhu Executive Director & Endowed Professor Institute.
Why PKI (Scott Rea) Boulder CO November 15, 2007.
Authentication. User Authentication - Defined The rapid spread of e-Business has necessitated the securing of transactions Authentication is a fundamental.
Institute for Cyber Security ASCAA Principles for Next-Generation Role-Based Access Control Ravi Sandhu Executive Director and Endowed Chair Institute.
Chapter 9: Network and Internet Security. Learning Objectives 1.Explain why computer users should be concerned about network and Internet security. 2.List.
Mobile Identity Management Mobile Payments Mobile Signatures © Copyright Valimo Wireless Ltd, 2006.
Web Application Development Instructor: Matthew Schurr.
Human Factor vs. Technology Joanna Rutkowska Invisible Things Lab Gartner IT Security Summit, London, 17 September, 2007.
Communication for the open minded Study on user identification methods in card payments, e-payments and mobile payments Summary of recommendations (WP5)
Identity, Payments, and Bitcoin: Big Changes Ahead Steve Kirsch CEO, OneID March 3, 2014.
A l a d d I n. c o m Authentication Mechanisms: A Myriad of Options and Opportunities Andrew Lindell Chief Cryptographer Aladdin Knowledge Systems Assistant.
Information Assurance Center Iowa State University 1 Data Security: Protecting data within an organization Doug Jacobson Information Assurance Center
Multi-factor Authentication Methods Taxonomy Abbie Barbir.
PKI: A Technology Whose Time Has Come in Higher Education EDUCAUSE Live! Web Seminar May 11, 2004.
Unit 2: Cyber Security Part 2 Network Appliances, Protecting the Network (Authenication, Encryption, Digital Certificates, Cookies, Captchas, Network Segmentation,
Fundamentals of Web Development Randy Connolly and Ricardo Hoar Textbook to be published by Pearson Ed in early Fundamentals.
Authentication at Scale by Xu Han. Account Types Device-Centric Authorization Channel Bindings Server-Side Technology Service Accounts and Delegation.
Dartmouth Authentication Factors – Why PKI and eTokens are required (Scott Rea) EDUCAUSE PKI Deployment Forum Madison, WI - April 16, 2008.
Copyright © Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE USC CSci530 Computer Security Systems Lecture.
© 2017 SlidePlayer.com Inc. All rights reserved.