Jesper Writes About Security

  One of the challenging aspects of defining a security strategy is to define how complex an attack you need to defend against. Over the years, I've seen far too many organizations that are trying to build complex reverse engineering capabilities to dissect potential malware, while leaving 85% or more of their environment unpatched, not implementing strong 2-factor authentication, or failing to perform basic hardening. Security is very often mostly about doing the basics well. If you cannot tell the board that you know who all the global root users are - including the ones that could become global root easily - implementing a complex data loss prevention solution is probably not the item that should be at the top of your list. One of the challenges in security is thinking through the threat environment we are facing. Typically, we can never measure anything with absolute certainty in security, and there is opinion in everything, but one thing that seems to work is bucketing things ...

Last time I wrote about how to decide which of the many many options for multi-factor authentication to use. While this involved a fairly complex spreadsheet of various options, they all pretty much came down to three things: If U2F/FIDO2 is an option, use that If not, use TOTP, or smartcards if you are in an enterprise If neither is possible any MFA provides more protection than no MFA To be honest, that’s pretty universal advice when it comes to MFA. If you want to just walk away with that, you can stop reading now. Everything else I have written in other articles, as well as this one,  is largely just justification and technical details leading to that summary.  States of Authentication Most of the time we think of authentication as a binary state; you are either authenticated or you are not. However, we can make our system more flexible if we are willing to accept a certain amount of complication.  First, consider the case where you have at some point authenticated. I...

In past articles we have covered a lot of different second factor options. We have talked about how they work, and covered advantages and disadvantages of each option. If you recall from the first article, the series started because someone asked “where do I go to learn about multi-factor authentication?” Hopefully, by now we can agree that we have a base level of knowledge about the topic, enabling us to switch to the decision making process. If you are doing this for yourself, you will at some point have to decide which factors you want to use for which service. If you are considering implementing or changing your multi-factor authentication (MFA) strategy for a business, you need to decide which factors to implement for internal users. Or, perhaps you are responsible for a customer-facing service and need to decide what to support for your customers.  Reasoning about MFA The first thing we need is a decision making framework; a way to reason about MFA options and which make sens...

  A decade and a half ago I stood in front of a group of people talking about authentication. Mostly I was there to do a deep technical dive into Windows credential management and authentication, but as usual when I gave that presentation, someone just had to ask what I thought about biometrics.  Biometric authentication - something you are - is a bit of a misnomer. It’s not authentication. It’s identification. You are, quite literally, identifying yourself. You’ll never see a police report say “law enforcement authenticated the criminal using fingerprints left on the scene.” Identity is something you are or something you claim to be. Authentication is how you prove it. If your authentication claim is your identity then you have identified yourself, as opposed to authenticated yourself. However, when we use biometry - the statistical analysis of biological observations - the identification decision is not binary. The evaluation of a biometric identity claim is based on a conf...

  In our journey through possession proofs we have encountered hardware factors of various kinds. HOTP and TOTP is often implemented as hardware devices, and of course, so are Smart Cards. In this post we will look at authenticators that implement the FIDO standards -  U2F, WebAuthn, and CTAP2. WebAuthn and CTAP2 are collectively part of the FIDO Alliance ’s FIDO2 protocol suite. U2F and UAF are older FIDO protocols that are supported under FIDO2. They can all be thought of as being part of the FIDO2 suite of protocols.  To understand these protocols, and their advantages and disadvantages, we need to be familiar with the three fundamental actors: Relying party (RP) - Also known as the server. This is the service that a user wishes to log into. Client - This is the application that brokers the authentication from the relying party to the authenticator and eventually the user. Much of the time, this is a web browser, but it could be any application. Authenticator - This ...