slide1 n.
Skip this Video
Loading SlideShow in 5 Seconds..
Authentication: the problem that will not go away PowerPoint Presentation
Download Presentation
Authentication: the problem that will not go away

Loading in 2 Seconds...

play fullscreen
1 / 19

Authentication: the problem that will not go away - PowerPoint PPT Presentation

  • Uploaded on

Protecting Online Identity™. Authentication: the problem that will not go away. Prof. Ravi Sandhu Chief Scientist 703 283 3484. The State of Cyber Security. We are in the midst of big change Nobody knows where we are headed

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about 'Authentication: the problem that will not go away' - jalena

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

Protecting Online Identity™

Authentication: the problem that will not go away

Prof. Ravi Sandhu

Chief Scientist

703 283 3484

the state of cyber security
The State of Cyber Security
  • We are in the midst of big change
  • Nobody knows where we are headed
  • Conventional wisdom on where we are headed is likely wrong
security schools of thought
Security Schools of Thought

We had it figured out. If the industry had only listened to us our computers and networks today would be secure.


Today’s and tomorrow’s cyber systems and their security needs are fundamentally different from the timesharing era of the early 1970’s.

change drivers

Stand-alone mainframes and mini-computers


Mutually suspicious

security with split


Enterprise security

Few and standard services

Many and new

innovative services



Change Drivers
authentication characterized
Authentication Characterized


  • is fundamental to security
  • is hard

Authentication can enable

  • single sign on (or reduced sign on)
  • digital signatures
authentication sliced
Authentication Sliced
  • Something you know
      • Passwords, Personal facts
  • Something you have
      • Smart card, One-Time-Password generator, PC …
  • Something you are
      • Fingerprint, Iris, DNA, Voiceprint, …
  • Multifactor = 2 or more of these
      • Leap to 2-factor from 1-factor provides biggest gain
      • 2 factors typically from different categories above
authentication sliced differently take 1
Authentication Sliced Differently: Take 1
  • Shared secrets versus public-private keys
      • Shared secrets do not scale, especially across administrative domains
      • Shared secrets do not facilitate single sign-on
      • The holy grail of public key infrastructure continues to offer the best hope for scalability and single sign-on
  • Mostly true BUT don’t forget
      • Kerberos, symmetric key single sign-on within an enterprise
      • ATM network
authentication sliced differently take 2
Authentication Sliced Differently: Take 2
  • One-way authentication versus mutual authentication
      • One-way authentication is the norm
      • It is particularly susceptible to phishing
      • One-time passwords are susceptible to MITM attacks due to lack of mutual authentication
strong authentication
Strong Authentication
  • Two-factor (or multi-factor)
  • Mutual authentication
existing authentication methods threats

Weak User Authentication

Strong User Authentication

Transaction Authentication

Existing Authentication Methods & Threats
why are these security measures vulnerable
Why Are These Security Measures Vulnerable?
  • Authentication technologies are vulnerable to MITM Phishing 2.0 attacks when:
    • They rely on weak, easily spoofable information
    • They rely on ‘shared secrets’
    • They use only one-way SSL security
  • Vulnerable Authentication Technologies :
  • IP Geo, Device Fingerprint, OTP Tokens, Scratch Cards, Grid Cards, Cookies, Text, and Pictures
man in the middle attacks are happening
Man-in-the-Middle Attacks Are Happening

A man-in-the-middle attack (MITM): attacker is able to read, insert and modify transactions between two parties without either party knowing that the link between them has been compromised.

  • CitiBank Attack:
    • July 10th, 2006
    • Defeated OTP Tokens
    • 35 MITM Sites in Russia
  • Amazon Attack:
    • January 3rd, 2007
    • Defeated Username/Password
  • Bank of America:
    • April 10th, 2007
    • Defeats Sitekey Cookie/Picture (Movie)
    • April 20th, 2007
    • Defeats OTP Token
the citibank attack decrypted
The Citibank Attack Decrypted

 Links to fake CitiBusiness login page, hosted in Russia by and routed through botnet.

 Phishing email

 Inputs and steals users’ credentials (including Token code) in real time at the actual site

 Attacker changes transaction or executes a new transaction

ip spoofing story
IP Spoofing Story
  • IP Spoofing predicted in Bell Labs report ≈ 1985
  • 1st Generation firewalls deployed ≈ 1992
  • IP Spoofing attacks proliferate in the wild ≈ 1993
  • VPNs emerge ≈ late 1990’s
  • Vulnerability shifts to accessing end-point
  • Network Admission Control ≈ 2000’s
evolution of phishing
Evolution of Phishing
  • Phishing 1.0
    • Attack: Capture reusable passwords
    • Defense: user education, cookies, pictures
  • Phishing 2.0
    • Attack: MITM in the 1-way SSL channel, breaks OTPs
    • Defense: 2-way SSL
  • Phishing 3.0
    • Attack: Browser-based MITB client in front of 2-way SSL
    • Defense: Transaction authentication outside browser
  • Phishing 4.0
    • Attack: PC-based MIPC client in front of 2-way SSL
    • Defense: Transaction authentication outside PC, PC hardening
sandhu s laws of attackers
Sandhu’s Laws of Attackers
  • Attackers exist
    • You will be attacked
  • Attackers have sharply escalating incentive
    • Money, terrorism, warfare, espionage, sabotage, …
  • Attackers are lazy (follow path of least resistance)
    • Attacks will escalate BUT no faster than necessary
  • Attackers are innovative (and stealthy)
    • Eventually all feasible attacks will manifest
  • Attackers are copycats
    • Known attacks will proliferate widely
  • Attackers have asymmetrical advantage
    • Need one point of failure
sandhu s laws of defenders
Sandhu’s Laws of Defenders
  • Defenses are necessary
  • Defenses have escalating scope
  • Defenses raise barriers for attackers
  • Defenses will require new barriers over time
  • Defenses with better barriers have value
  • Defenses will be breached
sandhu s laws of users
Sandhu’s Laws of Users
  • Users exist and are necessary
  • Users have escalating exposure
  • Users are lazy and expect convenience
  • Users are innovative and will bypass inconvenient security
  • Users are the weakest link
  • Users expect to be protected
operational principles
Operational Principles
  • Prepare for tomorrow’s attacks, not just yesterday’s
    • Good defenders strive to stay ahead of the curve, bad defenders forever lag
  • Take care of tomorrow’s attacks before next year’s attacks
    • Researchers will and should pursue defense against attacks that will manifest far in the future BUT these solutions will deploy only as attacks catch up
  • Use future-proof barriers
    • Defenders need a roadmap and need to make adjustments
  • It’s all about trade-offs
    • Security, Convenience, Cost