We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byMelissa Adkins
Modified over 2 years ago
Authentication: the problem that will not go away Prof. Ravi Sandhu Chief Scientist Protecting Online Identity
© Copyright Ravi Sandhu 2008 Page 2 The State of Cyber Security We are in the midst of big change Nobody knows where we are headed Conventional wisdom on where we are headed is likely wrong
© Copyright Ravi Sandhu 2008 Page 3 Security Schools of Thought OLD THINK: We had it figured out. If the industry had only listened to us our computers and networks today would be secure. REALITY: Todays and tomorrows cyber systems and their security needs are fundamentally different from the timesharing era of the early 1970s.
© Copyright Ravi Sandhu 2008 Page 4 Change Drivers Stand-alone mainframes and mini-computers InternetEnterprise security Mutually suspicious security with split responsibility VandalsCriminals Few and standard services Many and new innovative services
© Copyright Ravi Sandhu 2008 Page 5 Authentication is fundamental to security is hard Authentication can enable single sign on (or reduced sign on) digital signatures Authentication Characterized
© Copyright Ravi Sandhu 2008 Page 6 Something you know Passwords, Personal facts Something you have Smart card, One-Time-Password generator, PC … Something you are Fingerprint, Iris, DNA, Voiceprint, … Multifactor = 2 or more of these Leap to 2-factor from 1-factor provides biggest gain 2 factors typically from different categories above Authentication Sliced
© Copyright Ravi Sandhu 2008 Page 7 Shared secrets versus public-private keys Shared secrets do not scale, especially across administrative domains Shared secrets do not facilitate single sign-on The holy grail of public key infrastructure continues to offer the best hope for scalability and single sign-on Mostly true BUT dont forget Kerberos, symmetric key single sign-on within an enterprise ATM network Authentication Sliced Differently: Take 1
© Copyright Ravi Sandhu 2008 Page 8 One-way authentication versus mutual authentication One-way authentication is the norm It is particularly susceptible to phishing One-time passwords are susceptible to MITM attacks due to lack of mutual authentication Authentication Sliced Differently: Take 2
© Copyright Ravi Sandhu 2008 Page 9 Two-factor (or multi-factor) Mutual authentication Strong Authentication
© Copyright Ravi Sandhu 2008 Page 10 Existing Authentication Methods & Threats Strong User Authentication Weak User Authentication Transaction Authentication
© Copyright Ravi Sandhu 2008 Page 11 Why Are These Security Measures Vulnerable? Authentication technologies are vulnerable to MITM Phishing 2.0 attacks when: They rely on weak, easily spoofable information They rely on shared secrets They use only one-way SSL security Vulnerable Authentication Technologies : IP Geo, Device Fingerprint, OTP Tokens, Scratch Cards, Grid Cards, Cookies, Text, and Pictures
© Copyright Ravi Sandhu 2008 Page 12 Man-in-the-Middle Attacks Are Happening A man-in-the-middle attack (MITM): attacker is able to read, insert and modify transactions between two parties without either party knowing that the link between them has been compromised. CitiBank Attack: July 10 th, 2006 Defeated OTP Tokens 35 MITM Sites in Russia Amazon Attack: January 3rd, 2007 Defeated Username/Password Bank of America: April 10th, 2007 Defeats Sitekey Cookie/Picture (Movie)Movie ABN AMRO: April 20 th, 2007 Defeats OTP Token
© Copyright Ravi Sandhu 2008 Page 13 The Citibank Attack Decrypted Phishing Links to fake CitiBusiness login page, hosted in Russia by Tufel-Club.ru and routed through botnet. Inputs and steals users credentials (including Token code) in real time at the actual CitiBusiness.com site Attacker changes transaction or executes a new transaction
© Copyright Ravi Sandhu 2008 Page 14 IP Spoofing Story IP Spoofing predicted in Bell Labs report st Generation firewalls deployed 1992 IP Spoofing attacks proliferate in the wild 1993 VPNs emerge late 1990s Vulnerability shifts to accessing end-point Network Admission Control 2000s
© Copyright Ravi Sandhu 2008 Page 15 Evolution of Phishing Phishing 1.0 Attack: Capture reusable passwords Defense: user education, cookies, pictures Phishing 2.0 Attack: MITM in the 1-way SSL channel, breaks OTPs Defense: 2-way SSL Phishing 3.0 Attack: Browser-based MITB client in front of 2-way SSL Defense: Transaction authentication outside browser Phishing 4.0 Attack: PC-based MIPC client in front of 2-way SSL Defense: Transaction authentication outside PC, PC hardening
© Copyright Ravi Sandhu 2008 Page 16 Sandhus Laws of Attackers 1.Attackers exist You will be attacked 2.Attackers have sharply escalating incentive Money, terrorism, warfare, espionage, sabotage, … 3.Attackers are lazy (follow path of least resistance) Attacks will escalate BUT no faster than necessary 4.Attackers are innovative (and stealthy) Eventually all feasible attacks will manifest 5.Attackers are copycats Known attacks will proliferate widely 6.Attackers have asymmetrical advantage Need one point of failure
© Copyright Ravi Sandhu 2008 Page 17 Sandhus Laws of Defenders 1.Defenses are necessary 2.Defenses have escalating scope 3.Defenses raise barriers for attackers 4.Defenses will require new barriers over time 5.Defenses with better barriers have value 6.Defenses will be breached
© Copyright Ravi Sandhu 2008 Page 18 Sandhus Laws of Users 1.Users exist and are necessary 2.Users have escalating exposure 3.Users are lazy and expect convenience 4.Users are innovative and will bypass inconvenient security 5.Users are the weakest link 6.Users expect to be protected
© Copyright Ravi Sandhu 2008 Page 19 Operational Principles A.Prepare for tomorrows attacks, not just yesterdays Good defenders strive to stay ahead of the curve, bad defenders forever lag B.Take care of tomorrows attacks before next years attacks Researchers will and should pursue defense against attacks that will manifest far in the future BUT these solutions will deploy only as attacks catch up C.Use future-proof barriers Defenders need a roadmap and need to make adjustments D.Its all about trade-offs Security, Convenience, Cost
Sandhus Laws of Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security University of Texas at San Antonio Chief.
1 Laws of Cyber Security Ravi Sandhu Executive Director and Endowed Professor September 2010
The Future: Evolution of the Technology Ravi Sandhu Chief Scientist TriCipher, Inc. Los Gatos, California Executive Director and Chaired Professor Institute.
1 Rethinking Password Strategies Ravi Sandhu Chief Scientist
Institute for Cyber Security ASCAA Principles for Next- Generation Role-Based Access Control Ravi Sandhu Executive Director & Endowed Professor Institute.
Institute for Cyber Security ASCAA Principles for Next-Generation Role-Based Access Control Ravi Sandhu Executive Director and Endowed Chair Institute.
Communication for the open minded Study on user identification methods in card payments, e-payments and mobile payments Summary of recommendations (WP5)
Multi-factor Authentication Methods Taxonomy Abbie Barbir.
Introduction to Network Security INFSCI 1075: Network Security Amir Masoumzadeh.
Chapter 11 E-COMMERCE SECURITY. Chapter 10 Copyright © 2009 Pearson Education, Inc. Publishing as Prentice Hall1 Learning Objectives Explain EC-related.
Selecting a Strong Authentication Solution Scott Mackelprang, V.P. of Security Digital Insight.
Media Connect Influence Forum Hunter Valley, Australia 1 The Future of the Internet Paul Twomey President and CEO 9 September 2007 Media Connect Influence.
Copyright © 2003 Pearson Education, Inc. Slide 11-1.
1 Security and the Cloud: Cloud Trust Brokers Ravi Ganesan* Founder, SafeMashups
1 Ravi Sandhu Chief Scientist SingleSignOn.Net & Professor, George Mason University Mihir Bellare Chief Cryptographer SingleSignOn.Net & Professor, Univ.
1 IETF Security Tutorial Radia Perlman Intel Labs July 2010
Virtual Private Networks (VPNs) VPNs allow secure, remote, connections… but they don’t protect you from a compromised remote PC.
SECURITY AWARENESS. The Importance of Security Awareness Training Security Awareness Training provides the knowledge to protect information systems and.
Network Security Protecting An Organizations Network.
1 The Future of the Internet Paul Twomey President and CEO 9 May 2007 IGF Internet Governance Workshop Tokyo, Japan.
Chapter 10 Implementing Electronic Commerce Security Gary Schneider, 2003.
Authentication Nick Feamster CS 6262 Spring 2009.
1 E-business Security and Control 2 Opening Case: Visa 10 commandments for online merchants – Maintaining a network firewall – Keeping security patches.
May 20121(C) 2012 Platez Pty. Ltd. Patents Pending.
October 4th 2006Quantum Cryptography and Computing Workshop 1 What can Quantum Cryptographers Learn from History? Kenny Paterson
UNIT 2: Firewalls Content : Firewalls in general basic operation and architecture Main border firewalls using stateful inspection Screening firewalls.
© 2016 SlidePlayer.com Inc. All rights reserved.