The Fuzzy Future Of Identity Management

Download this InformationWeek December 2013 special issue on identity and access management, distributed in an all-digital format (registration required).

The traditional worker bee comes into the office, logs in to a dedicated computer via Microsoft Active Directory credentials, and gets access to local applications and data shares needed to conduct daily activities. Simple, familiar, controlled -- and totally out of date for companies dealing with mobile devices, cloud computing, BYOD, and the blurring line between work and home, business and personal.

As the use of mobile and cloud computing booms, we're outgrowing our trusty old technology for identity and access management. But our future vision -- to know a person's identity across all the multiple devices, cloud services, and roles he has -- isn't possible with today's still-emerging technology. This causes lots of confusion as vendors vie to be the next great thing and IT tries to determine where to place bets.

As emerging cloud and mobile technologies settle out over the next few years, we in IT must maintain control by buying into transitional technologies, and also staking out and enforcing sometimes-unpopular policies. Employees don't like passcodes on phones, or giving up their personal Dropbox storage for an enterprise option, or feeling like their company might erase personal information from a device, but adopting new technology comes at a cost. Balancing the benefits with the costs is the art of information technology.

If you're not assessing the impact that increased use of mobile devices, bring-your-own-device initiatives, cloud storage, and cloud apps are having on your identity and access management strategy, then you're falling behind. Here are some important places to start.

Two-factor technology with cloud
As we move away from the model of employees accessing on-premises software systems using only company devices and networks, we also increase our exposure to certain threats. Now, instead of needing to get onto the corporate network with an approved device to access SharePoint files, we could potentially connect to Box from any device and simply provide a user name and password. The upside of the cloud option is easier access to important data, but the downside is that now only a user name and password combination stands between an attacker and company information. Not that we would ever accuse you or your colleagues of creating weak passwords, but we need something better.

Two-factor technologies aim to supplement poor or lost passwords by introducing a second component to the identity process. RSA and Entrust are the well-known old guard with millions of deployments, and the two-factor options range from tokens and smart cards to phone callbacks and SMS messages. Most of these technologies convey one-time passwords (OTPs) that are good for a period of time once you've made an authentication request to a system such as a Web server, application, or VPN endpoint.

OTP has been around for a long time and is better than just a password, but it's susceptible to man-in-the-middle attacks and DNS poisoning, such as when an attacker captures the OTP when someone unknowingly inputs it into a fake form. And it often relies on having an extra thing, such as a token or smart card.

One of the most exciting two-factor technologies we've seen that alleviates OTP weaknesses is Cyphercor's LoginTC. Say a salesperson out on the road is accessing Salesforce.com at a coffee shop. If using LoginTC, she enters her primary credentials on the site, and a message pops up on her phone asking "yes or no" if the access is legitimate. She answers yes, enters a passcode on her phone that unlocks a local token, and a message goes back to grant access.

LoginTC has two big advantages over OTP. First, Salesforce doesn't need personally identifiable information such as a phone number because tokenized challenges travel over the certificate-based Android, Apple, and BlackBerry push notification networks. Eliminating stored personal information simplifies regulatory compliance. Second, there are no vulnerable OTP codes being transmitted through insecure channels such as SMS or via automated phone calls or via cycling hardware tokens that are then entered into some remote web interface form that might or might not be legitimate. And there's a third factor: It uses the smartphone that salespeople already carry. Simplicity like this is key to getting employee adoption.

Richard Dreger co-wrote this story. He is co-founder of WaveGard, a Washington, D.C.-based professional services firm focused on providing expert-level risk intelligence, data protection, and smart mobility solutions to its clients. Follow him on Twitter: @wavegard.

To read the rest of this story,
download the InformationWeek December 2013 special issue on identity and access management, distributed in an all-digital format (registration required).