PKI-Enabled Applications That work! Linda Pruss Office of Campus Information Security

Projects Strong VPN Authentication – Administrator access to restricted data networks via VPN Laptop/desktop full disk encryption – Data encryption for computers storing restricted data … the “lost” laptop problem

Strong VPN AuthN Passwords do not provide an adequate degree of safety for systems that process or store data elements defined as restricted. Password while easy to use are vulnerable to a wide variety of attacks and weaknesses including guessing, impersonation, observing, borrowing, snooping and dictionary attacks.

Strong VPN AuthN UW Madison adopted a modified version of the PCI DSS v 1.1 as the required security controls target for systems containing restricted data. PCI DSS 8.3 “Implement two factor authentication for remote access to the network by employees, administrators, and third parties. Use technologies such as VPN with individual certificates”

Strong VPN AuthN UW Madison adopted a modified version of NIST as best practice. Authentication Level of Assurance 3 (LOA3) should be used for people who have access to restricted data. – LOA3 requires 2factor authentication – Can be achieved with either soft or hard tokens

Strong VPN AuthN How to get beyond simple password? – Do it ourselves first Administrators and DBAs How to accomplish 2 factor authentication? – One Time passwords (a la RSA SecurID) – X.509 certificate authentication

Strong VPN AuthN Already had existing PKI infrastructure – Mostly used for S/MIME – No infrastructure for one time passwords VPN approach there is no need to re- configure individual servers and other network devices. Many VPNs (cisco) are pki-capable

Strong VPN AuthN Do-able – Admins – Limited and known population Eases Identity proofing while we shore up infrastructure

Strong VPN AuthN

Cisco ASA 5510 (server side)

Strong VPN AuthN Cisco ASA 5510 (server side)

Strong VPN AuthN CISCO SSL VPN Client (client side) – Integrated with Microsoft certificate store – Use IE and/or certificates MMC to manage certificates – Clients for Windows, Macintosh and Linux – Windows works with hardware token – Using x.509 for administrative access to ASDM management console, as well.

Strong VPN AuthN Certificate Issues: – Soft or hard tokens Not all OSs support hardware token Hardware allows – Password enforcement and – Private key never leaves token – Still subject to many of same attacks Keyboard loggers Phishing? Weak passwords

Strong VPN AuthN Certificate Issues: – Using the same certificate for multiple purposes – Validity periods (too short?) – Lost token or certs … Temporary password access – CRLs

Strong VPN AuthN Non-PKI Issues: – Multi-cast – Redundancy – Performance – Usability – Politics – Process – Licensing  cost

Full Disk Encryption Primary Objective – Research and recommend a FDE product for pilot implementation Many requirements One Requirement of Solution – Integrate with existing PKI infrastructure

Full Disk Encryption Typically disk/file encryption is done with symmetric keys Use public keys to encrypt the symmetric key Microsoft EFS uses public keys to encrypt the file encryption key. Because of the “preboot” nature of disk encryption and performance

Full Disk Encryption Instead tend to support strong authentication mechanisms (tokens, smartcards) For effective full disk encryption, password strength is critical ie. protecting the strong with the weak. Use “already deployed” tokens/smartcards as a mechanism to do strong authentication i.e. two factors.

Full Disk Encryption Selected SafeBoot (McAfee) as the FDE product to pilot. Safeboot has two ways to leverage our pki infrastructure: – Use token to store user symmetric key. Token password allows you to get to symmetric key. – Use user’s public key to encrypt user’s symmetric key. Then use token (with private key) to decrypt symmetric key.

Full Disk Encryption Use as key store – Allows 2 factor authN to decrypt hard disk – Must sync token password via management console Use to send encrypted symmetric key – No need to physically handle token – Must have public keys/certs available via external source ---LDAP, AD

Common Characteristics Leverage existing PKI infrastructure Protect restricted data Provide for strong authentication – Attaining LOA3 authentication assurance

Futures Strong AuthN to enterprise systems -Peoplesoft signon code -Strong AuthN to Web single signon -Expand use of S/MIME