Peace Out, Passwords Identity and Access Management for the rest of us

Identity and Access Management Security Discipline enabling: ◦Right Individuals access to the ◦Right Resources at the ◦Right Times for the ◦Right Reasons On an enterprise level, IAM addresses need to ensure appropriate access to resources across increasingly heterogeneous technology environments, and to meet rigorous compliance requirements

Access Controls Similar to what we’ve discussed in class: ◦There are many ways to verify identity ◦Multi-Factor Authentication ◦Biometrics ◦Protecting information assets the right way But how can you and I relate?

Biometrics at a consumer level Many companies are starting to manage access differently for users and consumers at various levels Using fingerprints and other multi-factor authentication, companies are making secure access to one’s personal information assets easy, whether it’s your paypal account info or pictures on your phone

Apple wasn’t first to the party Apple made a big splash with their fingerprint readers on iPhone 5S models and newer But Lenovo Thinkpads and HP Envy laptops have allowed users to link up to ten passwords to their fingerprints for a few years

Small scale issues From my professional experience… People tend to forget that their fingerprint is actually linked to a password; either a word, phrase or passcode Makes it hard to access or reset if you’re not there or your reader fails for some reason It makes access and identification easy but human element can complicate things

Large scale and security issues It’s a big deal if you forget your password and can’t verify your identity to change it It’s an even bigger deal if your fingerprint is cracked and a hacker gets your password to your online banking profile or your paypal account, etc. The fingerprint scanner on the iPhone made a splash for users and hackers

Big money in the hack In September 2013, shortly after the iPhone 5S was released, a security researcher collected donations to award to the first hacker to crack the new security feature. $14,000 was given to a German biometrics hacking group “We hope that this finally puts to rest the illusions people have about fingerprint biometrics. It is plain stupid to use something that you can’t change and that you leave everywhere every day as a security token.” ◦Frank Rieger, Chaos Computer Club ◦ fingerprint-scanner-hacked-by-german-computer-club/ fingerprint-scanner-hacked-by-german-computer-club/ ◦

…and again Many hackers and security specialists have reported that the new iPhone 6 models released in late 2014 suffer from the same flaw Except now with Apple Pay being a big feature with the new phones, the stakes are much higher for abuse of the security flaw Lookout, a mobile security firm suggests using a passphrase or a passcode in conjunction with the fingerprint for two-factor authentication “The attack requires skill, patience and a really good copy of someone’s fingerprint – any old smudge won’t work. Furthermore, the process to turn that print into a useable copy is sufficiently complex that it’s hightly unlikely to be a threat for anything other than a target attack by a sophisticated individual.” ◦Marc Rogers, Lookout Mobile Security

It’s not going anywhere Because we store an enormous amount of personal info on cell phones and they are so often subject to threat, it’s going to continue to be important for companies to develop new and better technology for access control to personal devices. Iris on the Move being integrated into future Samsung Galaxy devices biometric-identification-systems biometric-identification-systems Image acquisition system based on hi-res cameras, video synchronized strobed illumination and specularity based image segmentation In addition, FIDO Alliance (Fast Identity Online) is working to develop technical specifications that define an open, scalable, interoperable set of mechanisms that reduce the reliance on passwords to authenticate users. They are using systems that rely on tokens and biometrics to authenticate

Still hackable But as students of Information Security, we have to look at all new developments in consumer level access controls through a critical scope We have to assume that everything can be hacked and probably will be The important thing is that people are aware of potential security holes and can take strides to combat them on a personal level

Works Cited iphone-5s-fingerprint-scanner-hacked-by- german-computer-club/ iphone-5s-fingerprint-scanner-hacked-by- german-computer-club/ iphone_6_still_vulnerable_to_touchid_fing erprint_hack/ iphone_6_still_vulnerable_to_touchid_fing erprint_hack/ glossary/identity-and-access- management-iam/ glossary/identity-and-access- management-iam/