FERPA & Data Security:FERPA & Data Security: Passwords and Authenticators

2 Mike Tassey Data Security Advisor Privacy Technical Assistance Center (PTAC) Phone:

Agenda About schools and data security Passwords – How do they work? Various authenticator attacks Best Practices for password security Pro tips for individual data security How PTAC can help / Security Resources 3

FERPA & Data Security FERPA states that we must use “Reasonable Methods” to protect PII from student records from unauthorized disclosure. What does FERPA say about passwords or other data security controls? 4

FERPA & Data Security 5 Yup…Nada…Nothing…Zilch…

FERPA & Data Security Why doesn’t FERPA tell me how to protect student records? 6

FERPA is a child of the 70’s Records used to be paper Computers…. LOL Could not imagine longitudinal data systems, or linking computers together in a network FERPA was 9 years old when the Internet was born! FERPA & Data Security 7

We generally interpret reasonable methods to mean that set of security controls which would be deemed in line with current accepted security and privacy best practices for data of similar sensitivity. 8 rea·son·a·ble meth·od / ˈ rēz(ə)nəb(ə)l/ / ˈ meTHəd/

9  Cyber budget = $5.45 BillionCyber Budget = Gym Teacher FERPA & Data Security

How you prove who you are What you are allowed to access Who you claim to be 10 IdentificationAuthentication Authorization

FERPA & Data Security 11 Authentication Factors Something you know Something you have Something you are

FERPA & Data Security What are passwords? Strings of characters that you remember Hard to guess Rely on entropy 12

FERPA & Data Security A Double Edged Sword Onerous passwords get written down Password reuse can lead to compromise Supplement with additional factors 13

FERPA & Data Security Using brute force: PassWord1 = 9 Characters, Multi-case, Numbers log2(62) = 5.95 bits * 9 Characters = 54 Bits of Entropy 2^54 bits / 3,000,000,000 guesses/second = 69 Days PassWord1 = 3 words log2(7776) = 12.9 bits * 3 words = 39 Bits of Entropy 2^39 bits / 3,000,000,000 guesses/second = 3 Minutes 14 But “PassWord1” meets the requirements!

FERPA & Data Security Rainbow Tables Time / Memory Trade Off Precomputed solutions Simple lookup Reduces lookup time by orders of magnitude 15

FERPA & Data Security 16 Password Hashing Passwords not stored Hashing algorithms are one way functions that return a fixed length string unique to input Cannot determine the initial value from the hash

FERPA & Data Security 17 Using SHA256 Hashing Algorithm: Input Value: PassWord1 Output Value: c04265d72b749 debd67451c aa572742e3 222e86884de16 485fa14b55e7 =

FERPA & Data Security 18 In most modern authentication systems the hash is what is compared, not the password!

Let’s Hack Stuff 19

FERPA & Data Security Review: Application didn’t sanitize user input SQLi vulnerability enabled access to user hashes Unsalted MD5 hash is relatively trivial to crack Strong hashing or better filtering would have saved them 20

FERPA & Data Security Password Security Best Practices Complexity is nice, length is better Avoid common passwords Passphrases are better than words Change them often Don’t reuse Beware storing passwords in browsers 21

FERPA & Data Security Pro Tips for Digital Survival Set screen lock / passcode Stop clicking on stuff! Update software and OS regularly Look for HTTPS: in the URL Install and update AV / anti-malware Backup your data.. No seriously.. Do it. 22

PTAC Services & Assistance Privacy & security resources on: Data Sharing/Dissemination, Disclosure Avoidance, Data Security and Data Governance Legal References (FERPA and Cross-Agency) Technical Assistance site visits to State and local educational agencies Hands-on support for establishing and reviewing security policy, data governance, FERPA compliance, staff training, and related topics. Support center, including an interactive Help Desk, offering assistance via phone or . 23

ED/PTAC Resources available FERPA Training FERPA 101 professional training video FERPA 201 (Data Sharing) professional training video FERPA 301 (Postsecondary) professional training video FERPA 101 For Parents and Students Data Security Protecting Student Privacy While Using Online Educational ServicesProtecting Student Privacy While Using Online Educational Services Data Governance Checklist Cloud Computing Identity Authentication Best Practices Data Breach Response Checklist 24

Contact Information Family Policy Compliance Office Telephone:(202) FAX:(202) Website: familypolicy.ed.govfamilypolicy.ed.gov Privacy Technical Assistance Center Telephone:(855) FAX:(855) Website: ptac.ed.govptac.ed.gov 25