Downloaded 26 times
Uploaded byPing Identity
You Can't Spell Enterprise Security without MFA
The document discusses the importance of multi-factor authentication (MFA) in enhancing enterprise security by mitigating vulnerabilities associated with single-factor authentication. It explores various authentication factors, trends, and contextual verification to dynamically assess risk and optimize security, usability, and cost. Key recommendations include adopting risk-based MFA that evaluates the potential harm and likelihood of authentication mistakes while providing flexible options for different user scenarios.
More Related Content
Similar to You Can't Spell Enterprise Security without MFA
You Can't Spell Enterprise Security without MFA
- 1. You Can’t SpellEnterprise Security Without MFA Paul Madsen, Principal Technical Architect Office of the CTO Ping Identity Copyright 2013 Ping Identity Corp. All rights reserved.© 1
- 2. Agenda Copyright 2013 PingIdentity Corp. All rights reserved.© 2 •Why •What •Which •When & Where
- 3. WHY MFA? Copyright 2013Ping Identity Corp. All rights reserved.© 3 • Deficiencies & vulnerabilities of one factor mitigated by another (unless they are dependent) • Raises the bar for attackers • Compromise of one factor insufficient to enable attacker access to sensitive resources • Voted ‘Easiest to pronounce acronym’ 4 years in a row!
- 4. Copyright 2013 PingIdentity Corp. All rights reserved.© 4
- 5. 5 I come notto bury passwords but to appraise them
- 6. MFA is Using twoor more login factors in order to authenticate a user
- 7. MFA is Using twoor more login factors in order to authenticate a user multiple independent
- 8. MFA is Using twoor more login factors in order to authenticate a user Dynamically choosing from multiple independent
- 9. MFA is Using twoor more login factors in order to authenticate a user Dynamically choosing from implicit & explicit authentication multiple independent
- 10. MFA is Using twoor more login factors in order to authenticate a user/ with the optimal balance of security, usability, and cost Dynamically choosing from implicit & explicit authentication multiple independent
- 11. MFA is Using twoor more login factors in order to authenticate a user/ with the optimal balance of security, usability, and cost Dynamically choosing from implicit & explicit authentication/based on an assessment of risk (determined by analysis of various contextual signals and other considerations) multiple independent
- 12. MFA is Using twoor more login factors in order to authenticate a user/ with the optimal balance of security, usability, and cost Dynamically choosing from implicit & explicit authentication/based on an assessment of risk (determined by analysis of various contextual signals and other considerations) multiple independent
- 13.
- 14. Firstly, some secretthou knoweth, secondly some object thoust have in thy living, and thirdly some quality of thy p'rson
- 15. In practice •Something youforgot •Something you left at home •Something you are nervous about sharing 15
- 16. Key Authentication Trends Tropedoesn’t adequately acknowledge 1. Device as factor 2. Local authentication 3. Contextual verification
- 17.
- 18. Phones make great*have* factors •Connected •Computation •Storage •UI
- 19. Phones make great*have* factors •Connected •Computatio n •Storage •UI In a package a user won’t leave at home
- 20. yes no Is device authenticated? no yes User authenticated? Enjoypublic application access Enjoy public application access Authenticating device & user
- 21. yes no Is device authenticated? no yes User authenticated? Enjoypartial application access Enjoy partial application access User logs in from untrusted device. User logs in from untrusted device. Enjoy public application access Enjoy public application access Authenticating device & user
- 22. yes no Is device authenticated? no yes User authenticated? Enjoypartial application access Enjoy partial application access Enjoy full application access Enjoy full application access Device Registration Device Registration User logs in from untrusted device. User logs in from untrusted device. Enjoy public application access Enjoy public application access Authenticating device & user
- 23. yes no Is device authenticated? no yes User authenticated? Enjoypartial application access Enjoy partial application access Enjoy full application access Enjoy full application access Device Registration Device Registration User logs in from untrusted device. User logs in from untrusted device. Enjoy public application access Enjoy public application access Authenticating device & user Enjoy partial application access Enjoy partial application access
- 24. Stand up straight Copyright2013 Ping Identity Corp. All rights reserved.© 24 • If relying on device authentication, the ‘device posture’ of that device becomes paramount • This ‘device posture’ includes aspects like PIN, malware, screenshot enabled etc • In the enterprise, EMM solutions allow IT to define & enforce policies over device posture – and (in emerging trend) to report current situation into authentication systems • Work underway in the Identity Defined
- 25.
- 26. Local authentication • Capabilitiesof phones also make practical a model where the verification check is performed locally, ie on the device • As used for ‘device unlock’ – the user logically authenticates to the device • Local authentication (particularly for biometrics) has privacy advantages – no secrets on the server
- 27. FIDO Alliance Copyright 2013Ping Identity Corp. All rights reserved.© 27 • The issue with leveraging local authentication is how – A server can prompt the client to perform an authentication – How client can ‘prove’ to server that it did so • FIDO Alliance normalizes the above pattern • Abstracts away from the server the specifics of the local authentication on the client via an asymmetric cryptographic challenge/response pattern • Inherently multi-factor – must have the private key as well as the local factor (either know or are)
- 28.
- 29. Contextual verification • Contextualverification is a model of passively collecting signals & parameters from the user’s environment and analyzing/comparing them to identify anomalies (from expected) • In the context of authentication, supplements (or in some instance replaces) traditional overt & explicit logins. • Valuable because it can increase assurance without negative usability implications • Signals can be collected via multiple channels & touchpoints, e.g. device, browser, agents • Assumption is that attacker unlikely to be able to simulate all signals in order to impersonate valid user • Manifests as • Geofencing Copyright 2014 Ping Identity Corp. All rights reserved.© 29
- 30. Explicit giving wayto implicit Copyright 2014 Ping Identity Corp. All rights reserved.© 30 Explici t Implici t Trend Explici t Implici t
- 31.
- 32. Considerations when pickingfactors Copyright 2013 Ping Identity Corp. All rights reserved.© 32 • IT benefits Is the authentication method easy to deploy? Will it require additional IT resources? Can it work across multiple channels, e.g. online, telephony, etc? • Usability Is the authentication method easy to use? Will end users accept the new process? Can users be expected to have a device capable of supporting a particular mechanism? Will users be concerned about privacy?. • Initial costs Is there a cost per user that will grow every time a new user is added? What is the replacement cost – both for the device and its associated administrative burden? • Deployment costs What are the costs associated with deploying the authentication mechanism. Is client hardware or software required? If so, how is that distributed to consumers and what are the associated costs?
- 33. Copyright 2013 PingIdentity Corp. All rights reserved.© 33
- 34.
- 35. Analysis Low assurance High assurance Poor usability Good usability Smart cards OTP Hardware token Passwords Mobile authentication app Device fingerprinting Lowcost Medium cost High cost SMS OTP FIDO?
- 36.
- 37. Risky business Copyright 2013Ping Identity Corp. All rights reserved.© 37 • Risk-based MFA demands that resources be analyzed for the risk of their compromise • OMB m04-4 defines a model for assessing risk of an authentication mistake - determined by – Potential harm or impact – Likelihood of the authentication mistake • ‘Harm’ includes – Financial loss, damage to reputation, personal safety, civil/criminal prosecution • Once risk has been assessed, authentication factors can be chosen accordingly
- 38. Break away frompassword hegemony Copyright 2013 Ping Identity Corp. All rights reserved.© 38
- 39. Flexibility Copyright 2013 PingIdentity Corp. All rights reserved.© 39 • Particularly for consumer space, provide different options for MFA factors • Both to support heterogeneous user base and to offer fall back mechanisms if and when a particular factor doesn’t work, e.g. if a mobile phone is offline or if the consumer is roaming, fall back to a generated OTP
- 40.
- 41. MFA 2.0 1. Factorin context 1. Anomalies initially determined by policy, allow for natural learning future 2. Risk it 1. Choose authentication factors based on assessment of risk 2. Rely on contextual verification when possible 3. Device advice 1. Leverage local authentication and device authentication 2. Be sensitive to device posture Copyright 2014 Ping Identity Corp. All rights reserved.© 41
- 42. MFA 2.0 Copyright 2014Ping Identity Corp. All rights reserved.© 42 Risk & Policy EngineRisk & Policy EngineRisk & Policy EngineRisk & Policy Engine ContinueContinueContinueContinueStartStartStartStart Active AuthenticationActive AuthenticationActive AuthenticationActive Authentication DenyDeny BehaviorBehaviorBehaviorBehaviorContextContextContextContext ExternalExternal FeedsFeeds ExternalExternal FeedsFeeds CommunityCommunity IntelligenceIntelligence CommunityCommunity IntelligenceIntelligence DenyDeny Behavioural Feedback CorrelationCorrelationCorrelationCorrelation EnvironmentEnvironmentEnvironmentEnvironment ApplicationApplication infoinfo ApplicationApplication infoinfo PolicyPolicyPolicyPolicy
- 43. Policy Data Copyright 2014Ping Identity Corp. All rights reserved.© 43 IdP Device Environment Authenticati on MFA
- 44. Policy Data Copyright 2014Ping Identity Corp. All rights reserved.© 44 IdP RP Device Environment Authenticati on MFA Authorization
- 45.
- 46.