The Future: Evolution of the Technology Ravi Sandhu Chief Scientist TriCipher, Inc. Los Gatos, California Executive Director and Chaired Professor Institute.

Slides:

Advertisements

Similar presentations

INSTITUTE FOR CYBER SECURITY 1 Trusted Computing Models Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security University.

Advertisements

INSTITUTE FOR CYBER SECURITY 1 The ASCAA * Principles Applied to Usage Control Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.

Authentication: the problem that will not go away Prof. Ravi Sandhu Chief Scientist Protecting Online Identity.

1 Trust Evidence in Heterogeneous Environments: Towards a Research Agenda Ravi Sandhu Executive Director and Endowed Professor May 2010

INSTITUTE FOR CYBER SECURITY 1 Application-Centric Security: How to Get There Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.

1 Trust Evidence in Heterogeneous Environments: Towards a Research Agenda Ravi Sandhu Executive Director and Endowed Professor May 2010

INSTITUTE FOR CYBER SECURITY 1 Industry-Academia Research Synergy: Fantasy or Reality? Ravi Sandhu Executive Director and Endowed Professor Institute for.

Institute for Cyber Security (ICS) Prof. Ravi Sandhu Executive Director and Lutcher Brown Endowed Chair

INSTITUTE FOR CYBER SECURITY 1 The PEI + UCON Framework for Application Security Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.

Sandhus Laws of Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security University of Texas at San Antonio Chief.

Managing Cyber-Identity, Authorization and Trust (and their inter-relationships) Prof. Ravi Sandhu Laboratory for Information Security Technology George.

Institute for Cyber Security ASCAA Principles for Next- Generation Role-Based Access Control Ravi Sandhu Executive Director & Endowed Professor Institute.

INSTITUTE FOR CYBER SECURITY 1 The PEI Framework for Application-Centric Security Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for.

Institute for Cyber Security ASCAA Principles for Next-Generation Role-Based Access Control Ravi Sandhu Executive Director and Endowed Chair Institute.

1 Laws of Cyber Security Ravi Sandhu Executive Director and Endowed Professor September 2010

1 New Trends and Challenges in Computer Network Security Ravi Sandhu Executive Director and Endowed Professor September 2010

© 2006 Ravi Sandhu Cyber-Identity, Authority and Trust Systems Prof. Ravi Sandhu Professor of Information Security and Assurance Director,

Experiences with Massive PKI Deployment and Usage Daniel Kouřil, Michal Procházka Masaryk University & CESNET Security and Protection of Information 2009.

1 Cyber Security Research: A Personal Perspective Prof. Ravi Sandhu Executive Director and Endowed Chair January 18, 2013

AUTHENTICATION AND KEY DISTRIBUTION

Overview Network security involves protecting a host (or a group of hosts) connected to a network Many of the same problems as with stand-alone computer.

Chapter 10 Real world security protocols

1 Cloud Computing Prof. Ravi Sandhu Executive Director and Endowed Chair April 12, © Ravi Sandhu World-Leading.

1 Federated Identity and Single-Sign On Prof. Ravi Sandhu Executive Director and Endowed Chair February 15, 2013

Attribute-Based Access Control Models and Beyond

Kerberos Jean-Anne Fitzpatrick Jennifer English. What is Kerberos? Network authentication protocol Developed at MIT in the mid 1980s Available as open.

A Role-Based Approach to Federated Identity Ravi Sandhu * Chief Scientist NSD Security Ravi Sandhu * Chief Scientist NSD Security

 Key exchange o Kerberos o Digital certificates  Certificate authority structure o PGP, hierarchical model  Recovery from exposed keys o Revocation.

Copyright © B. C. Neuman, - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE Fall Security Systems Lecture notes Dr.

Identity and Access Management: Strategy and Solution Sandeep Sinha Lead Product Manager Windows Server Product Management Redmond,

31.1 Chapter 31 Network Security Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.

INSTITUTE FOR CYBER SECURITY 1 Cyber Security: Past, Present and Future Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security.

USCGrid A (Very Quick) Introduction To PubCookie

1 Challenges of Cyber Security Education at the Graduate Level Ravi Sandhu Executive Director and Endowed Professor Nov. 9, 2012

1 Grand Challenges in Authorization Systems Prof. Ravi Sandhu Executive Director and Endowed Chair November 14, 2011

Module 9: Fundamentals of Securing Network Communication.

Kerberos. What is Kerberos? Network authentication protocol Developed at MIT in the mid 1980s Available as open source or in supported commercial software.

® Gradient Technologies, Inc. Inter-Cell Interworking Access Control Across the Boundary Open Group Members Meeting Sand Diego, CA USA April 1998 Brian.

1 The Quest for Single-Sign On Prof. Ravi Sandhu Executive Director and Endowed Chair February 8, © Ravi Sandhu.

Fall 2010/Lecture 321 CS 426 (Fall 2010) Key Distribution & Agreement.

Single Sign-On in the Danish Educational Sector Per Thorboll Deputy director UNI-C.

Traditional Security Issues Confidentiality –Prevent unauthorized access or reading of information Integrity –Insure that writing or operations are allowed.

Internet2 AdvCollab Apps 1 Access Grid Vision To create virtual spaces where distributed people can work together. Challenges:

© ITT Educational Services, Inc. All rights reserved. IS3230 Access Security Unit 7 Authentication Methods and Requirements.

Web Services Security Patterns Alex Mackman CM Group Ltd

1 Panel on Data Usage Management: Technology or Regulation? Prof. Ravi Sandhu Executive Director and Endowed Chair DUMA 2013 May 23, 2013

Cyber in the Cloud & Network Enabling Offense and Defense Mark Odell April 28, 2015.

1 Cyber Security A Personal Perspective Prof. Ravi Sandhu Executive Director and Endowed Chair January 15, 2016

1 Open Discussion PSOSM 2012 Prof. Ravi Sandhu Executive Director and Endowed Chair © Ravi Sandhu.

1 SUBMITTED BY- PATEL KUMAR C.S.E(8 th - sem). SUBMITTED TO- Mr. DESHRAJ AHIRWAR.

Active Directory Domain Services (AD DS). Identity and Access (IDA) – An IDA infrastructure should: Store information about users, groups, computers and.

1 Understanding Which New Threats Operators Can Expect To Face Within The Next Two To Five Years To Improve The On- Going Management Of Security Systems.

INSTITUTE FOR CYBER SECURITY 1 Purpose-Centric Secure Information Sharing Ravi Sandhu Executive Director and Endowed Professor Institute for Cyber Security.

Secure Connected Infrastructure

Web Applications Security Cryptography 1

Symmetric Cryptography

Computer Communication & Networks

What can Technologists learn from the History of the Internet?

Client Certs -- the old-new thing

Cryptography Basics and Symmetric Cryptography

Protecting Online Identity™

Challenge-Response Authentication

Cyber Security Research: Applied and Basic Combined*

Authentication and Authorization Federation

Big Data and Privacy Panel Prof. Ravi Sandhu

Challenge-Response Authentication

Application-Centric Security

ASCAA Principles for Next-Generation Role-Based Access Control

Cyber Security Research: A Personal Perspective

Cyber Security Research: Applied and Basic Combined*

Presentation transcript:

The Future: Evolution of the Technology Ravi Sandhu Chief Scientist TriCipher, Inc. Los Gatos, California Executive Director and Chaired Professor Institute for Cyber Security University of Texas at San Antonio Protecting Online Identity

© Ravi Sandhu, 2008 Page 2 Summary We are in the midst of big change Nobody knows where we are headed Conventional wisdom on where we are headed is likely wrong

© Ravi Sandhu, 2008 Page 3 Security Schools of Thought OLD THINK: We had it figured out. If the industry had only listened to us our computers and networks today would be secure. REALITY: Todays and tomorrows cyber systems and their security needs are fundamentally different from the timesharing era of the early 1970s.

© Ravi Sandhu, 2008 Page 4 Change Drivers Stand-alone mainframes and mini-computers InternetEnterprise security Mutually suspicious security with split responsibility VandalsCriminals Few and standard services Many and new innovative services

© Ravi Sandhu, 2008 Page 5 Now we face a new challenge to security, a world of shared computing and web services. As with radio, this technology is too valuable to go unused, By contrast with radio, which could be protected with cryptography, there may be no technology that can protect shared computation to the degree we would call secure today. In a decade or a generation, there may be no secure computing. Diffie on Information Security … 2007 Need to be realistic in our security expectations

© Ravi Sandhu, 2008 Page 6 Butler Lampson Paraphrased (I think) Computer scientists could never have designed the web because they would have tried to make it work. But the Web does work. What does it mean for the Web to work? Security geeks could never have designed the ATM network because they would have tried to make it secure. But the ATM network is secure. What does it mean for the ATM network to be secure?

© Ravi Sandhu, 2008 Page 7 The SSO Challenge Timesharing, 1970s: SSO problem: need to login to every application SSO solution: let OS do authentication, after that it is authorization Score: successful but 100% centralized Distributed systems, 1980s: SSO problem: need to login to every host SSO solution: maintain trust lists at each host Score: disastrous beyond a tiny scale Kerberos, 1980s: SSO problem: need to login to every host SSO solution: centralized server w/crypto-authentication to hosts Score: successful within a domain but symmetric key crypto does not scale beyond enterprise boundary

© Ravi Sandhu, 2008 Page 8 The SSO Challenge SSL, 1990s: SSO problem: need to login to every webserver SSO solution: PKI Score: half successful, webserver certs deployed but no browser certs WebSSO, 1990s, early 2000s: SSO problem: need to login to every webserver SSO solution: carry authentication information in browser cookies Score: successful within a domain but passwords do not scale beyond enterprise boundary The future as per conventional wisdom, late 2000s, early 2010s: SSO problem: need to login to every webserver, many being external SaaS SSO solution: PKI plus federation Prediction: PKI will remain in some form, federation will remain in some form BUT todays conventional wisdom is likely dead wrong

© Ravi Sandhu, 2008 Page 9 ezSSO Secure, Convenient, Connected Secure: Yes By virtue of the ladder even if the bulk of users are at the lowest end Back-end passwords are not known to the user Convenient: Yes Needs to be proven in the field Connected: Yes Rapid onboarding of relying parties