>> One of the more effective security controls that we
can implement into networks is strong Authentication.
The job of authentication is to force
a user to prove their claimed identity.
I claim to be administrator.
You can claim to be anything you want.
Now, I need you to prove it.
Traditionally, we've had three ways we
proved our claim: something I know,
something I have, and something you are.
There's also something you do and somewhere you
are with GPS positioning and tracking.
We're even extending the ways to prove it.
The problem with that is any single form
of authentication can be spoofed.
We always want to combine more than one factor.
When we talk about more than one factor,
I don't mean two somethings you
have like a driver's license and a passport.
That's not multi-factor.
We want to combine at least two types
of authentication so that way,
we can have a better standard of proof.
Multi-factor authentication is best.
Bullet point here at the bottom.
Mutual authentication, that's also desirable.
Not only do I authenticate to you,
you authenticate back to me.
For instance, you connect to a banking server.
We're used to that banking server
requesting our username and password.
We have to prove our identity to the banking server.
We also want that banking server to
>> prove its identity to
>> us so that we know it's not a rogue device,
which is where digital certificates come in.
Most common is definitely something you know.
We use passwords.
Traditionally, we've had password best practices,
includes ideas like change
your password on a regular basis,
use uppercase and lowercase,
have alphanumeric, non-alphanumeric.
Not only do you change your password every so
often but enforcing a password history.
What's very interesting about this is
NIST and the gentlemen that
specifically wrote the NIST standards
for passwords has essentially come out and said,
"All those ideas we've had in
the past really are not accurate today."
We used to be a very good preventative controls
your passwords was based on
the knowledge and tools at the time.
Right now, the types of attacks
that attackers are doing upper,
lowercase, alphanumeric,
non-alphanumeric, these don't matter anymore because
their password scanning programs are
going to try all those combinations.
What makes passwords harder today is length.
As you add additional length to your password,
you add more entropy.
You make it more difficult for
>> an attacker to determine.
>> We really have made passwords very
difficult for ourselves to remember.
How many times have you gone to the same site,
typed a password 3, 4,
or 5 times, thought you knew what it
was and turns out it's a password from another site?
It can be very frustrating.
What a lot of users do is they
just write their passwords down,
which is obviously, that's a security vulnerability.
What we want is longer passwords,
not passwords that are hard to remember.
Something you have. If you can't touch it,
it's something you have.
There are also other non-tangible things
that you would have like a private key,
digital certificates, or cookies on your system.
If you log on to a system and it
says we don't recognize your computer,
that's because when you set up your account initially,
that web server put a cookie on
your system that it looks each time you log in.
That's one way of verifying
your identity, with a cookie.
A lot of times,
we make this multi-factor authentication as seamless
as possible because we don't want to
annoy users and pester them to death,
but we do want that multi-factor authentication.
A lot of organizations are using smartphones today.
You go and log in with the password.
I'm going to send you a code to your phone.
The fact that you know
the code proves to me that you have a phone.
It's fairly unobtrusive.
If you have a password on your phone, you get access.
Other somethings you have.
We use memory cards for a long time.
The memory card is a magnetic strip on
the back of our credit cards without encryption.
There's just stored information on that strip
and very easy to siphon off those credit cards,
very easy to clone a credit card,
and very easy to copy these.
What you have in the top illustration is
a little shim that fits over
the legitimate credit card reader,
and you can see it can't even tell
the difference. Then you swipe your card.
It's actually being read by the shim,
as well as being passed along to the reader.
Very easy to do credit card theft, credit card fraud,
billions of dollars a
year are lost with credit card theft.
A deterrent for that or
an alternative is to use the PIN and chip system.
These are smart cards.
You can tell they're smart cards because they have
a processor on them.
The idea is these could
actually provide three-factor authentication.
You got the chip, something to have;
you know the PIN, something you know.
If you sign it on the back and if
the cashier checks your signature
on whoever takes the card,
then you actually have something you know,
something you have, and something you do
or something you are just
depending on the classification,
how you classify signatures.
That's not really the way it works
today because many times,
cashiers don't check the signature.
Even if they glance at it,
they're not really looking for any similarities.
A lot of times, the vendor systems
don't have the chip reader enabled.
When it comes right down to it,
if that chip reader is disabled,
then we just swipe our cards in
the magnetic reader with a magnetic strip again.
We don't really get all the benefits
of the chip and PIN system
because we don't really enforce them
the way that they should be enforced.
Now the third category, something you are.
This used to be considered something you are,
and the biometrics included
both physiological and behavioral traits.
Behavioral traits are how I walk, talk, and type,
but now they move that to its own category,
which is something you do.
Now when we talk about something you are,
it's just your physiological traits: palm scan,
thumbprint, iris scan, retina scan.
Whatever those traits are,
how well you match to those traits
determines whether or not you gain access.
Now somewhere you are.
Because of GPS trafficking and positioning,
the fact that I'm in Kelly Handerhan's house
proves that I'm Kelly Handerhan.
Again, we still want to combine that with multi-factor,
other factors for authentication.
Then there's something you do.
Like I said, how I perform certain activities.
Some cell phones don't have
a PIN to open up the lock screen,
then you have a swipe pattern in a certain way.
There are all sorts of little quirks that are unique
to us and how we walk or sign
a document or how we type our names
can be good identifiers of an individual.
The thing about biometrics
specifically is we have issues with false positives
and false negatives or what's really better
referred to as false acceptance and false rejections.
Let's say that I've decided to use
my thumbprint for access to my laptop.
I've got sensitive information on there,
so I want to make sure nobody that
shouldn't get access gets onto my system.
I provide my thumbprint and I require the match to be
100 percent accurate before
letting someone onto the system.
Well, I'm not going to be 100 percent accurate,
different pressure, different way I roll my thumb,
could be scratches or dust on my fingerprints.
If I require such a high match before
letting out or letting into the system,
I'm going to be locked out over and over.
That's a lot of administrative hassle
and it's very frustrating.
I'm tired of being locked out of my own system.
You know what, anybody with a thumb can get in.
Well, the problem there is there'll be
>> false acceptances.
>> People that shouldn't be allowed
in are going to be allowed in.
What you're going to find is that false acceptances
and false rejections are inversely related.
As one goes up, the other goes down, and vice versa.
There will be a point where the two of them meet.
That point is called the crossover error rate.
That's how the accuracy of the system is assessed.
Where the FRR meets the FAR is the CER.
That's just for those of you that like letters.
Otherwise, where your false acceptances
meets your false rejections,
that's called the crossover error rate,
and that indicates the sensitivity
or the accuracy of the system.
Other things to think about with biometrics is cost.
Does it warrant a high-end biometrics solution?
Also, user acceptance.
Users are not 100 percent
comfortable with all forms of biometrics.
Still to this day, if I say,
"Hey, I got my thumbprint taken yesterday."
The first question is did you have to go
downtown? Were you speeding?
What was going on? We tend to still
associate being thumbprinted
or fingerprinted with crimes.
We feel like they're very intrusive
into our personal space.
If the biometrics gets compromised,
you can't revoke them.
If my password gets lost or compromised,
I can revoke that password,
get issued a new one, and I'm good to go.
If my thumbprint is compromised,
not much I can do about that.
There are other issues like enrollment time.
Biometrics are the best
of the single-factor authentication,
but there are definitely drawbacks to them as well.
Even if you decide the pros outweigh the drawbacks,
don't forget it should just be
implemented as one part of a multi-factor system.
Of course, our multi-factor systems are going to
combine more than one type: something you know,
something you have, something you are,
something you do, somewhere you are.
You have to have that because
any single means of authentication can be spoofed.