Tag Archive for Access control

| September 24, 2016
Comments Off on FIDO

FIDO

FIDOSince 2013 there have been nearly 5 billion data records lost or stolen according to the Breach Level Index. The UN says there are 6.8 billion mobile phone accounts which mean globally 96% of humans have a cell phone. It would seem that these factoids could interact to cut the pace of lost or stolen data records. An effort is underway to use mobile devices to better secure data called FIDO.

https://fidoalliance.org/FIDO (Fast ID Online) is an open standard for a secure and easy-to-use universal authentication interface. FIDO plans to address the lack of interoperability among strong authentication devices. TargetTech says FIDO is developed by the FIDO Alliance, a non-profit organization formed in 2012. FIDO members include Agnitio, Alibaba, ARM (ARMH), Blackberry (BBRY), Google (GOOG), Infineon Technologies, Lenovo (LNVGY), Master Card, Microsoft (MSFT), Netflix, Nok Nok Labs, PayPal, RSA, Samsung, Synaptics, Validity Sensors and Visa.

The FIDO specifications define a common interface for user authentication on the client. The article explains the goal of FIDO authentication is to promote data privacy and stronger authentication for online services without hard-to-adopt measures. FIDO’s standard supports multifactor authentication and strong features like biometrics. It stores supporting data in a smartphone to eliminate the need for multiple passwords.

encrypted virtual containerThe author writes that FIDO is much like an encrypted virtual container of strong authentication elements. The elements include: biometrics, USB security tokens, Near Field Communication (NFC), Trusted Platform Modules (TPM), embedded secure elements, smart cards, and Bluetooth. Data from authentication sources are used for the local key, while the requesting service gets a separate login to keep user data private.

FIDO is based on public-key cryptography that works through two different protocols for two different user experiences. According to TargetTech the Universal Authentication Framework (UAF) protocol allows the user to register an enabled device with a FIDO-ready server or website. Users authenticate on their devices with fingerprints or PINs, for example, and log in to the server using a secure public key.

authenticate users with a strong second factorThe Universal Second Factor (U2F), originally developed by Google, is an effort to get the Web ecosystem (browsers, online service providers, operating systems) to authenticate users with a strong second factor, such as a USB touchscreen key or NFC on a mobile device.

FIDO’s local storage of biometrics and other personal identification is intended to ease user concerns about personal data stored on an external server or in the cloud. By abstracting the protocol implementation, FIDO also reduces the work required for developers to create secure logins.

Samsung and PayPal have announced a FIDO authentication partnership. Beginning with the Samsung Galaxy S5 users can authorize transactions to their PayPal accounts using their fingerprints, which authenticates users by sending unique encrypted keys to their online PayPal wallets without storing biometric information on the company’s servers.

Samsung and PayPal FIDO authentication partnershipFIDO promises to clean up the strong authentication marketplace, making it easier for one-fob-fits-all products. The open standards shift some of the burdens for protecting personally identifiable information to software on devices or biometric features, and away from stored credentials and passwords. ComputerWeekly described FIDO’s potential this way:

The FIDO method is more secure than current methods because no password of identifying information is sent out; instead, it is processed by software on the end user’s device that calculates cryptographic strings to be sent to a login server.

In the past, multiple-factor authentication methods were based on either a hardware fob or a tokenless product. These products use custom software, proprietary programming interfaces, and much work to integrate the method into your existing on-premises and Web-based applications.

same authentication device can be used in multiple ways for signing into a variety of providersComputerWeekly says FIDO will divorce second-factor methods from the actual applications that will depend on them. That means the same authentication device can be used in multiple ways for signing into a variety of providers, without one being aware of the others or the need for extensive programming for stronger authentication.

Integrating FIDO-compliant built-in technology with digital wallets and e-commerce can not only help protect consumers but reduce the risk, liability, and fraud for financial institutions and digital marketplaces.

The big leap that FIDO is taking is to use biometric data – voiceprint, fingerprint, facial recognition, etc. and digitize and protect that information with solid cryptographic techniques. But unlike the traditional second-factor authentication key fobs or even the tokenless phone call-back scenarios, this information remains on your smartphone or laptop and isn’t shared with any application provider. FIDO can even use a simple four-digit PIN code, and everything will stay on the originating device. With this approach, ComputerWeekly says FIDO avoids the potential for a Target-like point-of-sale exploit that could release millions of logins to the world, a big selling point for many IT shops and providers.

Target-like point-of-sale exploitIt can eliminate having to carry a separate dongle as just about everyone has a mobile phone these days this is a mobile world we live in, and we need mobile-compatible solutions; otherwise, you’re behind the curve right out of the gate.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , , , , , , ,
| December 17, 2013
Comments Off on Wiring Closet 3.0

Wiring Closet 3.0

Wiring Closet 3.0The lowly wiring closet at the edge of the network is evolving. You know the one’s that IT shares with the custodians or the women’s lav. The neglected place that connects all end-points into the enterprise network infrastructure. Throughout my career we have moved from 3Com SuperStack hubs to 10/100 SuperStack switches to 100/1000/10000 Cisco 2960’a fixed Ethernet devices. In this first edge era, the primary buying criteria was the price per port. Low price was the critical factor. These devices might have had a few network services but they only provided best-effort connectivity services with little to no operational control according to Nick Lippis in the Lippis Report 103: Wiring Closet Switches Gain Strategic IT Value Label.

Baystack stackCommoditized network gear created enterprise networks consisting of equipment from different vendors. Purchases throughout the wiring closets, distribution, and core were based mainly on cost. The article says that equipment from multiple vendors is the hallmark of Wiring Closet 1.0. Wiring Closet 1.0 made effective management difficult. Multiple management systems required that organizations keep a large staff with diverse skills to keep up network functionality.

Wiring Closet 2.0

Most organizations are now in the Wiring Closet 2.0 era. As competition drove margins on edge switches into the single digits, the author states that vendors began to add services to a new breed of device. The new features on 2.0 switches created new ways for the vendors to compete on different (rb- and more profitable) fronts beyond price per port. Mr. Lippis argues enterprise trends are forcing IT executives to check projects, programs, and priorities as they seek to drive down Total Cost of Ownership (TCO) while extracting added value from their enterprise network. Business executives expect their IT departments to meet continually growing demands without significant year-over-year network expenditures. (rb– the ever popular more with less argument) The article says the new realities include new mixed traffic patterns and increased desktop bandwidth requirements for new applications, communications, and data center strategies.

Goddard rocket scientistSwitch vendors recognized these trends. They responded by developing a new type of wiring closet switch. Second-generation switches added significant functionality. The vendors’ goal is to transform the commoditized network edge (rb- low profit) into a strategic IT asset (rb- high profit). The blog says these new switches enable a host of new applications for Wiring Closet 2.0.

  • Quality of Service: Wiring Closet 2.0 switches tag applications like IP telephony and Unified Communications at access to guarantee priority throughout an internal network and active monitoring
  • Power Over Ethernet (PoE): Second generation, wiring closets distribute power over Ethernet cables. POE enables new classes of devices to be powered from the Wiring Closet 2.0. These demands include WLAN access points, video surveillance, and IP phones. As well as specialty devices such as health care instrumentation, point of sale devices and soon even laptops.
  • Security: The network edge Is the first level of defense. Network Access Control (NAC) and application policing have increased in importance. They are needed to protect the integrity of the network, data privacy, and compliance. Wiring Closet 2.0 switches integrate security features and the support of security appliances bolstering defense-in-depth strategies.
  • Wireless Local Area Networking: WLAN integration, which includes access point, PoE, and controller support, increases WLAN coverage. Further common network management interfaces streamline operational support for both wired and wireless networks.
  • Unified Communication (UC): UC support via PoE to power IP phones and UC end-points plus unique UC configuration profiles to ensure reliable and stable UC operation.
  • Application Intelligence: Application intelligence or the categorizing of applications as they enter the wiring closet and either mark them with QoS or discard the application. This enables application policing at the network edge.
  • Layer 3: Full layer 3 forwarding enabling all the value associating with routing including segmentation and aggregation are now included in some wiring closet switches.
  • Total Cost of Ownership: The network edge and wiring closet switches in particular have a TCO breakdown of 20% capital spend and 80% operational spend according to Gartner (IT). Mew wiring closet switches are more expensive from a capital acquisition point of view. However, their operational cost is lower. Thus, the total dollar spend over a three-year period will also be lower while delivering increased value to the enterprise.

Wiring Closet 3.0

The IT industry is on the verge of a new era at the network edge. New technologies and requirements will disrupt Wiring Closet 2.0.

  • 10Gbps Ethernet: 10Gbps Ethernet is the future of networking. If the past is a guide to the future, then over time more and more 1 Gbps Ethernet ports will upgrade to 10 Gbps. This will place a strain on wiring closet packet processing performance while driving up 10Gbps port density requirements plus downstream distribution and core switch capabilities.
  • Software-defined networking (SDN): The holy grail of SDN is to separate the network control plane from the data plane. The model I carry in my head is wireless networks. There is a central controller that tells the WAP’s what to do and they do their job without any help from the central controller. This implies that the network devices can be dumber and cheaper.
  • Network Management: Consistent network management means leveraging the same supplier for the network edge, distribution, and core.
  • True Layer 3 Support: To support all the above-mentioned trends and unforeseen applications, wiring closet switches need to support full layer 3 forwarding.
  • Support of UC, Mobility, and Security: This basis of competition is one of the most important attributes to the new network edge. Wiring closet switches need to support both standard interfaces and services for UC, mobility, and security so that mixed vendor solutions may occur.
  • IPv6: If you have wiring closets full of perfectly good Layer 2 switches, there’s no reason to replace them just because you can’t manage them with IPv6. If they work today, they’ll work until they break, and you don’t need to worry about (or budget for) swapping them out any sooner.

IPv6

IPv6

Dan Campbell, President, Millennia Systems, Inc. suggested in a recent CircleID post that to manage the move to an IPv6 enabled Wiring Closet 3.0. Organizations should strive to use theIPv6 dual-stack migration strategy. This is where IPv6 is added to the existing systems so they can simultaneously function with both IP versions. Tunneling and translation techniques should be used when the dual-protocol configuration is not possible. The mantra of “dual stack where you can, tunnel where you must” is the order of the day.

He advises that starting today, don’t buy another box unless it supports dual-stack operation or offers a clear, well-defined upgrade plan. It doesn’t matter if the manufacturer is “up and to the right” in the latest Gartner (IT) report; anything you buy from now on that is IPv4-only is a waste of valuable resources.

Mr. Campbell tells network administrators that while LAN switches function mainly at layer 2. They forward Ethernet frames regardless of whether the packet inside is IPv4 or IPv6. There are some functions on a switch that works at layer 3 or higher. They include:

• Dynamic ARP Inspection (DAI).
• DHCP Snooping.
• Multicast Listener Discovery (MLD) Snooping (the IPv6 equivalent of IGMP Snooping).
• Quality of Service (QoS) marking for upstream Differentiated Services treatment.
• Access Lists (e.g., VLAN or regular ACLs).

He explains that these features need layer 3 or upper-layer information; Layer 3 is needed to inspect the packet header or payload inside the Ethernet frame. These features may not be things you are doing now, but you never know when you will. Security requirements and hardening guidelines are recommending things like DAI, DHCP Snooping, and ACLs at the access layer.

The more streaming video gets moved to IP networks, the more the need for multicast. MLD Snooping is necessary to improve performance. Finally, the continued convergence of voice, video, and other rich media and interactive applications to IP networks is furthering the need for QoS. It is always best to mark traffic as close to the edge as possible.

Related articles

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: low voltage | Tags: , , , , , , , , ,
| October 25, 2012
Comments Off on Attacking Electronic Door Access Control Systems

Attacking Electronic Door Access Control Systems

Attacking Electronic Door Access Control SystemsDarkReading pointed out research by independent security researcher, Shawn Merdinger, into vulnerabilities within embedded door access control systems. The researcher investigated the inner workings of electronic door access controls (EDAC). Mr. Merdinger disclosed some of his findings at the 2010 CarolinaCon conference.

S2 Security logoThe DarkReading article Attacking Electronic Door Access Control Systems reports that the researcher found several flaws in the S2 Security NetBox. According to the firm’s website, more than 9,000 customers in 50 countries worldwide use S2 Security Corporation’s integrated security management platforms. Among the flaws in the system, he found an unauthenticated factory reset and unauthorized access to backup data. The author says the first issue is obviously a pretty serious one that could lead to a potential denial of service, but it’s the last one that turns heads.

According to the CarolinaCon presentation, the backup files are stored in a location with predictable file names that do not need authentication to access. Inside a software dump of the electronic door access control system, an attacker can find goodies like the configuration and something that might come in handy like the administrator’s password hash. From there, the attacker can do pretty much anything he or she wants, including unlocking doors at will.

door access control system, administrator’s passwordThe article further states that Mr. Merdinger found that the door access control database also has the user names, passwords, and IP addresses for the network cameras and digital video recorders (DVRs). Now the attacker can watch the facility, learn traffic patterns, and plan for a physical penetration of the facility. The stolen credentials will allow the attacker to turn off cameras and/or recordings during their assault on the facility. To make matters worse, Mr. Merdinger points out that marketing folks for these products will actually state that it’s safe to put these management systems on the Internet. And apparently, people do, because in the presentation he demonstrates production systems that are online with a Shodan search.

DarkReading acknowledges that the presentation doesn’t stop at showing the scary stuff. It takes the next step that most audiences are dying to see, but don’t always get, and that’s how to fix these things as both the vendor and the customer. The blog recommends the video, the detailed paper, and his updated presentation from Hack in the Box 2010 (in Dubai) on attacking electronic door access control systems.

Related articles
  • New Access Control Technology Holds the Key to Safer Schools: Unique RFID-based System Addresses the Shortcomings of Expensive and Inefficient Alternatives (prweb.com)

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , ,