Archive for the ‘Info Sec’ Tag

Warning: Do Not Access (Pretty Please?)

I just read an article over at Dark Reading that made me laugh, and almost cry at the same time. An employee at the Defense Department was just arrested for accessing unauthorized data. And how did the he gain access? By using a password that he received in order to access another classified message that he had authorized access to.  Despite automated security warnings (that the employee ignored, and didn’t even bother to read), the employee was able to access the classified data on two separate occasions.

So what’s wrong with this picture? Two words: Least Privilege. Why does a privileged identity have unrestricted access? The password that the employee was provisioned with should only have allowed him access to data that he had legitimate access to and nothing else. On top of that, there should be some type of attestation to verify the access rights of these privileged accounts.

It’s laughable to think that warning messages was the only thing that stood between the employee and the classified data. You could make the argument that he shouldn’t have been snooping into the restricted area in the first place, but that would just plain be naïve. Let’s face it; access policies are put in place to protect data owners from this sort of thing, and to protect employees from themselves! Looks like the Defense Department needs to review their access management a bit.

The Identity Enclave

We all have our own distinct identities: at home, at work, and all throughout the internet. Each of these identities used to have its own logical boundaries that separated one from the other. But with more and more of our personal information becoming available on the internet, dots are now easily connected, and suddenly the boundaries are becoming blurred. Now all it takes is knowing how to use Google, and anybody can potentially hijack an identity within your organization. If a genius like David Kernell can do this, then pretty much anybody can. So how can an organization secure its identity enclave?

We can start by closing off this attack vector. David Kernell hacked Governor Palin’s email account by answering the Governor’s question and answer pairs to reset the password on the account. How did he know the answers? Google.

Question and answer pairs are an effective way to authenticate, and it’s probably not going away anytime soon. One way to strengthen the security of this method is to append or prepend a base passphrase to each answer.

Say your base passphrase was “MySecretPassphrase”. A question like “What is your favorite color?” could be answered as “MySecurePasshraseBlue” instead of just “Blue”. Ideally, the base passphrase would be something that is easy to remember such as song lyrics or even an old street address.

There are other ways to secure the question and answer pair method. Have some methods of your own? Leave a comment and let us know.

Also, don’t forget, Ian Yip’s survey on Managed Identity Services will be closed on Sunday October 12 at 11:59PM GMT. Take the survey if you haven’t done so, and share some of your thoughts on implementing Managed Identity Services and Outsourcing.