On Cyber-Attacks and Authentication Credentials: Cyberdefense’s Weak Underbelly

June 29, 2017 Nok Nok News 0 comments

The cascade of cyberattacks from the WannaCry ransomware that encrypted hospital computers to the Dyn attack that took down large swaths of the internet, to the most recent GoldenEye (or Petya) malware that is still sweeping the globe, the parade is never-ending. In a recent article in the New York Times, IDT Corporation’s Global CIO Mr. Ben-Oni outlined an attack on his company that is worth reading closely for several key take aways.

A deep investment of millions of dollars in anti-virus, intrusion detection and firewall systems, did not prevent the critical attack that masqueraded as ransomware but was really aimed at stealing employee credentials to create an ongoing compromise of IDT’s systems. According to the article, Mr. Ben-Oni followed advice that he had received from an N.S.A. employ and deployed three firewalls, three antivirus solutions, and three detection systems. Mr. Ben-Oni was rigorous in subscribing to 128 publicly available threat intelligence feeds, 10 subscription threat intelligence feeds (costing IDT hundreds of thousands of dollars annually) and each and every preventative measure he put in place failed to catch the attack.

What is vitally important is that the attackers were after employee credentials. Once you compromise authentication, you have the keys to the kingdom and you can take your time emptying out the vault.

Also, note that the layered network defenses from some of the foremost vendors in the world failed to protect against this attack. Millions of dollars were spend on modern-day detection systems were ineffective in protecting the company.

What can we learn from this? First – we must use Multi-Factor Authentication rather than single credentials – particularly ones that can be harvested and replayed against us. Second, the Cyber-Defense playbook needs to be changed to prioritize the strengthening of credentials over the layering of network defenses. There will always be zero-day vulnerabilities and tools such as the leaked NSA “Double Pulsar” that will be used to get past these network cyber defenses. The integrity of our systems, networks and computing infrastructure at a corporate and national level, relies then on securing the core authentication credentials that are the keys to the kingdom.

The attack demonstrates that network oriented approaches are mere “band-aids” without using some accompanying “antibiotics” – the important first step is to secure authentication and then layer on the network defenses. There’s a failure in critical thinking when we continue to pour hundreds of millions of dollars into a failed defensive strategy while neglecting core defenses. Authentication is under attack as the weak underbelly of cybersecurity.

It has been a while since I looked at the combined dollars going into the network oriented cyber defensive companies relative to those offering strong authentication but I see some tipping points ahead as we start to rethink cyber-defense from the ground up and start to secure authentication. When we founded the FIDO Alliance and worked on its core protocols (FIDO-UAF and subsequently U2F and FIDO2.0) a principal design goal was to prevent scalable attacks by dramatically raising the cost of attacking authentication and we have achieved that quite well.

Beyond this specific attack on IDT, the last Verizon Data Breach report estimated that 81% of cyberattacks involved a stolen or compromised authentication credential – that is a stunning indication of where our underbelly lies. At a recent industry conference, both Google and Microsoft spoke about their identity-aware proxies as a layered defense mechanism for their cloud services. Separately, FIDO Alliance was spoken about extensively by NCCOE, NIST and many private companies such as Microsoft and Google, as a key building block for security & identity. At Nok Nok Labs, we are working on a closer integration of device/user and network authentication. Perhaps the IDT attack and the alarm bells sounded by Mr. Ben-Oni will persuade smart CIOs and boards to actively accelerate changes in their authentication strategy.

14 Jun

5 Min read

Can Blockchain Change the Face of Identify Management?

June 14, 2017 Nok Nok News 0 comments

Dig a little deeper and you will understand that Bitcoin is an implementation of a “distributed ledger” that is called a blockchain. Rather than keeping critical records in a central database like almost every company does today, blockchains distribute the ledger information to many different computers. Then when a process requires information from the ledger, it asks all the connected machines to propose the answer. When a majority agree, they are rewarded for their efforts in the form of digital coins. If information on one machine was manipulated, the majority would still be trusted.

A couple of years after Bitcoin was released, some in the cryptocurrency community began to think about making the blockchain more powerful. Rather than just holding information, what if the blockchain could hold a program that executed when triggered? Developers released a new type of blockchain with a specialized programing language that could be used to write “smart contracts”. This new chain was called Ethereum. These smart-contracts have made it easier for teams to build applications that use these distributed network effects. Infact, these applications have a name (dApps) and sometimes even have their own digital coins (altcoins).

Regardless, today, blockchain aficionados think of Bitcoin and Ethereum as the two major public blockchains that should be considered for business functionality, and with this operating model, blockchains become an interesting architecture for managing identity.

Identity on the Blockchain

As much as you’d like to think you control your identity, you really don’t. Vast repositories of information about you are controlled by private companies that make money every time another company needs to validate who you are. Today, we have an identity ecosystem that requires thousands of organizations to pay these identity holders to perform some sort of “proofing” to validate that a user is who they claim to be:

Your utility company may have validated your address.
Your bank may have validated your payroll.
Your hospital may have validated your birth.
Your government may have validated your SSN.
Your mortgage company may have validated you creditworthiness.

Each of these organizations have invested in due diligence in “know your customer” processes, and they each now have a piece of the total identity puzzle that is you. But each new credit check requires yet another set of validations, and in the end, your identity gets spread wider and wider into more centralized databases that can be hacked.

With blockchain, we can fundamentally change how management of identity takes place.

First let’s start with a radical premise – that you should own your identity information, and should be able to control who sees it – and even be compensated when your information is valued by someone else.

Now Imagine an app called MyID that you install on your phone for a small fee of $1.99. This app – tied to your phone becomes the trusted digital wallet of your identity. Using your biometrics, only you can access the app, and the biometrics data and the identity data all sit within your phone and are never transferred to a server elsewhere without your permission.

Once your app is installed, you go through an identity proofing process where you answer questions that allows MyID to validate who you are and issue a certification for each piece of identity that it validates. These certificates live in the blockchain and therefore can’t be altered, and the underlying data sits encrypted on your phone and also can’t be altered.

With this model, you have a favorable configuration for the consumer. They can share proof that MyID has validated their identity (tied with the device), or they can share the underlying identity data piecemeal as they see fit.

If a credit card company wants to issue you a credit card, they can request various data points, and may give you more credit or a lower rate if you provide more certified identity data.

If an online advertising company wants to better target advertisements to you based on your income, you can share your certified income level (but not your contact information) with them for a fee (payable to you) for a piece of every advertisement you look at – which can be managed on a different blockchain.

Large companies are not left out of this loop. If your mobile network operator already has identity data about you, they can contribute that information to you and can certify if. Now when a third party wants that info, both you and the MNO can get a cut of the fees with your permission.

With blockchain technology, we have the opportunity to reframe risks of identify theft, while also bringing stronger privacy and digital rights to end consumers. There are many reasons why this is the future architecture of identity – and consequently there are many reasons why incumbent organizations will do whatever they can to delay or prevent it from emerging.