The advent of user created, managed and handled passwords as the sole means of authenticating is coming to an end. The utility of these was defined in an era based on assumptions of brute force capability, system computing power and pro-active security teams. – After much debate and analysis … there is the thesis
This is Part II of the topic being explored and discussed at my Wednesday session at the RSA Conference in San Francisco (2013). To see the first thesis and False Premise 1, please see the original post. Jumping right in – looking forward to more feedback (thanks for a generous emails, but don’t be shy at the comment field below)!
————————————————————————
FALSE PREMISE TWO: Password strength should transcend devices – mobile, tablets (iPad, surface) [Updated 2/12/2013]
MOBILE devices:
What is the intent of the password? To stop high CPU encryption cracking systems .. or prevent inadvertent strangers from accessing the data? Today we wrap in mobile (BYOD type if that suits you) systems into the corporate password requirement sphere, and in some cases are being more creative than other platforms.
For instance, it is recommended on a popular Apple iOS device site to use “accent characters for creating a super strong password“. Agreed these are more difficult to guess, but is that the threat we are seeking to mitigate? In the space of X character spaces how creative must we get?
What are the risks to these mobile devices:
- Theft
- Data leakage violating regulatory, contractual, or privacy expectations of customers
If we consider the two threats – Theft is not mitigated by the password, as the device will simply be wiped.
[Updated 2/09/13] Data leakage is only possible if the device is ON and the password guessed before it locks itself permanently. A feature readily available and easily implemented by the end-user, even more robust with corporate implementation technologies.
- So in this case, the password only needs to not be one of the top 10 most common phone passwords. At that point the device locks and can self wipe.
- Another scenario is that the password was gleaned through recording / shoulder surfing / or simply left unlocked. Each case the password strength was not an issue. Other situations?
As we move into an ever mobile, data everywhere, and always connected scenario an interesting ecosystem of access & authentication appears, that requires continued serious challenge against the assumptions of our security and assurance programs.
Diving in …
Data is mobile – what role does a single password play in accessing sensitive data? Data stored on device (Cloud storage we can address on the integration point below) is at risk to a number of threats:
- The device can be attacked directly (similar to any other computing device with IP addresses and Ports) wirelessly, but typically requires physical proximity (simplest) which is reserved for either random or very targeted attackers.
- The device can be stolen, and if no OS passwords, than the Data itself is attacked/accessed directly. An unlocked device introduces risk mitigation techniques that are harder, so password is EASIEST. A password on the data within an application is a worthless without some form of self-destruct functionality similar to that of the OS level safeguards.
>> Why are passwords WORTHLESS at the application level in this situation?
>>> If the attacker is ON the device (physically or remotely) and our Use Case is an encrypted database – the attacker can copy that encrypted database to their system for local attacking (easy and zero user awareness), or they can access the database locally via brute force until they get in.
The data is at risk regardless without some form of self-destruct and tremendous levels of assurance related to the encryption of the data(base) itself.
- Other thoughts here?
- What is missing?
Passwords plays a significant role at certain tollgates upon the data (when stored on the device), and less the more “access” the attacker gets to the underlying system. A common refrain of attackers is – with “physical” access I can break into anything. We must today deal with ALL ACCESS is PHYSICAL when the data is mobile.
Plethora of devices – Today data is accessed from many devices, some owned by corporations, by end-users, or nobody – kiosks. Single passwords entered into systems allowing single thread authentication where NO assurance is understood of the underlying system and no situational awareness of the User presence seeking authentication results in failed security.
- The reuse of passwords across devices threatens the confidentiality of the password itself (as much as that matters).
- The multitude of devices increases the need to redefine what is “access” and the functions of authorization (I used “functions” instead of “rules” intentionally to draw attention on the necessity for a broader approach to solving this constraint)
Integration with third party service providers – [to be expanded…]
—————————-
Conclusion – a preview:
- Stationarity, is defined as a quality of a process in which the statistical parameters (mean and standard deviation) of the process do not change with time.” – Challis and Kitney November 1991
- Offline Data level authentication – Offline in an ‘always connected’ world
[Disclaimer: First off this is my research and not anyone else’s. Second, the examples above are meant to illustrate technical realities in a reasonably understood presentation. Lets focus on the problem .. identify weaknesses in the argument; and introduce the mitigation so greatly required in our online world.
I share and seek these answers for the preservation and enhancement for our way of life… as simple as that and I appreciate you being a part of my journey]
Always seek, everything…
James DeLuccia
Twitter: @jdeluccia