Downloaded 154 times
More Related Content
Similar to Two factor authentication 2018
Two factor authentication 2018
- 1. SATURDAY, MARCH 17,2018 Two Factor Authentication Will Adams Software Architect Fiserv, Inc.
- 2. • What isit? • Authentication Factors • Not to be confused with… • Software token apps • Why do we need it? • Recent headlines • The problem with passwords • How do we implement it? • A word about standards • Adding a second factor Agenda
- 3. • Something youknow • Password • PIN • Security questions Authentication Factors
- 4. • Something youhave • Disconnected tokens – e.g. RSA • Connected tokens – e.g. YubiKey • Smart cards Authentication Factors – cont’d
- 5. • Something youare – i.e. biometrics • Fingerprint • Voice • Face • Retina/Iris Authentication Factors – cont’d
- 6. • Geolocation • Newand upcoming factor • For example, GPS • Offers convenience at the risk of privacy • Requires GPS and Internet connectivity to be accurate • Geofence locations such as home or office are whitelisted • Geolocation can be guessed so data should be signed using asymmetric cryptography to certify it came from a trusted device Authentication Factors – cont’d
- 7. • Two-step Verification •Authentication factors can belong to the same category • An extra measure of security over static login info • Can be compromised by man-in-the-middle attack • Ex: one time passwords (OTPs) or security images Not to be confused with…
- 8. • Google Authenticator •Generates 2-step verification codes using Time-Based One Time Passwords (TOTP) and HMAC-based OTPs • A shared secret key is exchanged during setup between server and app usually via QR code scan • Available for iOS or Android • Authy • Provides 6-digit TOTPs for 2SV but also has multi-device support • Available as a browser extension • Encrypted backups in the Cloud Software Token Apps
- 9. • February 2014– Target stores • Credit card data compromised • Resulted from stolen network credentials • 2014 – JPMorgan Chase • Stolen employee credentials • Attackers compromised personal info for 83 million customers Recent Headlines
- 10. • Password Hell… TheProblem with Passwords
- 11. • Ease ofsharing and reuse • Prone to attacks – phishing, malware, brute force • Complex passwords are often written down • Creates a single point of failure without 2FA or MFA • According to Verizon 2017 Data Breach Investigations Report, 81% of hacking-related breaches leveraged either stolen and/or weak passwords The (Real) Problem with Passwords
- 12. • FIDO (FastIDentity Online) Alliance • Group of leading companies like Google and Microsoft that develop standards to enable a simpler and more secure authentication experience across websites and mobile services • UAF (Universal Authentication Framework) • Designed as a replacement for basic authentication • Typically involves biometrics where security info never leaves the device • U2F (Universal Second Factor) • Strengthens and simplifies 2FA using USB, NFC or Bluetooth devices • Has strong security that protects against phishing, session hijacking, man-in-the- middle and malware attacks • Native support offered by major vendors and browsers A Word About Standards…
- 13. • Two-step verification •Two-factor authentication Demos
- 14. • Two FactorAuthentication book by Mark Stanislav • https://www.amazon.com/Two-Factor-Authentication-Governance- Publishing/dp/1849287325 • Pro ASP.NET Web API Security book by Badrinarayanan Lakshmiraghavan • https://www.apress.com/us/book/9781430257820 • Articles: • Authy vs. Google: https://authy.com/blog/authy-vs-google-authenticator/ • MFA Best Practices: https://www.pingidentity.com/content/dam/ping-6-2- assets/Assets/white-papers/en/mfa-best-practices-securing-modern-digital- enterprise-3001.pdf?id=b6322a80-f285-11e3-ac10-0800200c9a66 Resources
- 15. • Websites • developers.yubico.com •twofactorauth.org • authy.com Resources, cont’d
- 16.
- 17. • @RemoteArchitect • Slidesand source to be made available after Code Camp Thank You!
Editor's Notes
- #6 Typically a factor substitution and not a second factor of authentication Can have false positives and false negatives – i.e.: A false positive is when the system incorrectly accepts a biometric sample as being a match. (Same as false accept) A false negative is when a valid biometric sample is provided but the system falsely rejects it as not a match. (Same as false reject)
- #8 Have server store OTPs and establish a validity period to offset risk from MITM attack. OTPs as part of 2SV are in-band and phone calls used to verify identity are out-of-band. Goal is to have out-of-band process.
- #10 Also Tesla and Slack were compromised.
- #12 Password complexity rules and length do nothing to stop a phishing attack.
- #13 Specs emphasize a device-centric model. Authentication over the wire happens using public-key crytography. User’s device registers the user to a server by registering a public key. To authenticate the user, the device signs a challenge from the server using its private key. Keys on the device are unlocked by a local user gesture such as a biometric or pressing a button.