So What's the Authentication Answer? - 3 Factors of Fail (part 7 - last!)

   We've been discussing the authentication problem for the better part of two months, and now it's time to wrap things up.  If you've gotten to this post through a link but haven't read the rest of the series, it starts with part 1 here.

   Each of the 3 factors of authentication have serious issues when used individually.  The challenge is that we need to log a person into a system or application in a way that reasonably assures the person is who they say they are and has rights to the system.  And, perhaps most importantly, any method we use has to work well for people!

   So, how do we find a solution?

   The key is to think about the user and the use.

Multi-Factor Fail - 3 Factors of Fail (part 6)

from: brainyquote.com

   In December I was at the NG Security Conference in Austin, TX.  We had a fantastic discussion with a group of key security leaders focusing on this "quote" and how it applies to information security.  I say "quote" because there is some question as to who said this or if anyone actually did!

   As I've been saying throughout this series of posts, it seems that this statement is exactly what we are doing in the world of authentication!  None of the typical factors of authentication have really solved our authentication and access problems, yet we continue to use the same mechanisms over again.

The 4th Factor? - 3 Factors of Fail (part 5)

   Welcome to the next installment of my ramblings on authentication, 3 Factors of Fail.  So far we have discussed the classic 3 factors of authentication in parts 1, 2, 3 and 4.

   In recent years some additional authentication assurance methods have been grouped to form what some call the 4th factor of authentication.  This is also called risk-based, location-based or adaptive authentication.  It could also be called "somewhere you are" or "something you are doing".

   The basis of this method is in establishing a rich profile of the user.  This can include:

• the machine used for access;
• software used;
• time or day of accesses;
• IP address(es) used;
• what country the connection comes from, or;
• what actions the user attempts.

Something You Were - 3 Factors of Fail (part 4)

   Today we'll continue our discussion on problems in the world of authentication.  Here are links to parts 1, 2 and 3.

   The 3rd form of authentication is typically called Something You Are.  We typically think of this as some kind of biometric indicator like fingerprints.  But this is probably the earliest and most basic form of authentication used in human or animal species.

   Animal species can identify members by sight, but more often scent or sound.   In addition to the traditional 5 senses, some animals have senses that humans do not, like echolocation, to help identify "friend or food".  Here are some interesting articles.

   Human babies can identify their mother by smell and sound.  People have used visual recognition as a primary identification method for most of the existence of the human race.  Of course, visual recognition can be spoofed. And there are other reasons why visual recognition may not be the best identification method.

3 Factors of Fail - The Authentication Problem

   Authentication is one of the biggest challenges in information security. We can have all kinds of technical security measures in our systems. There are various controls we can have at the data level. But we still need to allow people to use the systems and get to the data. I should say... we need to allow the right people to use the systems and get to the data! Authentication is how we decide who the right people are.

   Federal regulations like HIPAA, PCI, IRS 1075 and others have major focus on minimum necessary.  That is, giving a user the minimum access they need to do their job.

   Wikipedia defines authentication as: (from Greek: αὐθεντικός; real or genuine, from αὐθέντης authentes; author) is the act of confirming the truth of an attribute of a datum or entity. This might involve confirming the identity of a person or software program, tracing the origins of an artifact, or ensuring that a product is what its packaging and labeling claims to be.  And Webopedia has: The process of identifying an individual, usually based on a username and password.  Interesting that this latter definition directly refers to username and password.

   There has been plenty of news in the past couple of years of breaches involving theft of a password file (encrypted or unencrypted) and customer/citizen personal data. Example like: eHarmony, LinkedIn, South Carolina Dept. of Revenue, and Utah. Many of these attacks involved exploiting authentication.