Coats

Benjamin Corll, VP, Cyber Security and Data Protection, Coats

When it comes to granting appropriate access to a company, network, or computing system, one has to question: how do we do this and do it securely? History, and tradition, will say that one gets a set of credentials to prove that they are an authorized person. This generally means a set of username and a password will be provider to a person. Ideally this would be a unique account for each person for them to prove their identity. There are still systems or reasons for a shared account, yet those should truly not be used for everyday activities or BAU (business as usual) activities as they lose the ability to track activities back to a single user. Granted, there are some built-in administrative accounts which should be the emergency or "in case of emergency, break glass" type of accounts. For instance, when all else fails, use the root account. The usage should be restricted and logged.

There are a couple of issues when it comes to user and identity management. These range from how we truly identify or authenticate a user and goes down to how we grant access to said user. Granting access isn't the hard part, the hard part is doing it in a way that is both convenient for an end user yet difficult for an attacker to usurp or take advantage of.

First Part - Authentication:

One of the main issues we have is how we identify the user. A simple username and password has been an accepted practice since before I started in the IT industry back in the mid-90's. Unfortunately, this simply isn't adequate any longer. Why? Because it doesn't protect the account or truly verify a user. If the credentials are lost, there is no telling who is using it. To combat this, or rather, to enhance this solution, there have been a couple of solutions. A popular solution is the implementation of multi-factor or two-factor authentication (MFA | 2FA). Traditionally this is who you are (username), what you know (password), and what you have (token, SMS code, biometric such as fingerprint). What this prevents is attacks such as brute-force attacks (which is where an attacker tries to guess the password using large lists of passwords against any given username) as the username & password alone won't be enough if the attacker doesn't have the additional token information. This also prevents leaked credentials, such as those where a user gets a phishing email which requests the user to change their password. They click on a link to supposedly change the password by entering the existing username & password, then they get an error saying it was unsuccessful and to try again later. Well, unfortunately they just gave their credentials to an attacker. Said attacker than uses those credentials for their own nefarious purpose(s). And another attack that MFA defends against is a password reuse attack. This would be when a user reuses their password across multiple services. If one service gets breached and the password obtained, an attacker could get the password from company or service A and then use the same password log into company or service B. All of these won't be successful logins if the attacker doesn't have the additional token.

“Granting access isn't the hard part, the hard part is doing it in a way that is both convenient for an end user yet difficult for an attacker to usurp or take advantage of”

Additionally, to authenticate a user, there are other options outside of credentials. Getting rid of credentials all together, using things like a Yubikey (example, not only company doing this) or hardware authentication. These support multiple authentication protocols and can be a token or ones which require the hardware plus requiring fingerprint or biometric additionally. This takes authentication away from the end user. Reduces the chances of the above attacks and it reduces password reset requests. A smoother end user experience as well. Stronger security and better workflows.

Still, there are other options too, such as password less logins with things like Windows Hello. This type of login would be hardware supported secure way to access a Windows 10 device using a few options:  a pin, a camera for facial recognition, and even a fingerprint. These would be verify difficult for a remote attacker to obtain and use against an system to gain unauthorized access.

Nothing is perfect, yet proper identification starts with stronger methods to authenticate the user and prove the identity of said user.

Second Part - Access Rights:

Once the user has been identified, through authentication, the next thing to do is know what a user is allowed to do. Not everyone does the same thing and we shouldn't all have access to the same things. Thus comes in role based access controls (RBAC) and adopting principles of access like PoLP or principle of least privilege.

Looking at the role a user is fulfilling, an organization can assign rights to a role. Then assign a user to that role. This allows scale better than assigning individual rights to each and every user. This allows us to assign role-based access and do it efficiently.

The second aspect is only assigning the rights or permissions that a person would need to do their job. So least privilege is accomplished by only giving access to rights one needs to perform their function. Such as, only those in HR gets access to the HR network share. Only those who are authorized to change data get the ability to write or delete data. Others may only get read access. And just because a user is in HR doesn't mean they get access to all folders (or even get access in general). An HR person in Peru doesn't necessarily need access to HR data from Japan. That might be outside their scope of responsibility, so they don't get access if not needed. By reducing the access an organization is able to protect sensitive data as unauthorized persons do not get access to it. This makes is more difficult for an unauthorized person to extract sensitive data from an organization. By using role-based access controls, the authorized persons still get easy and convenient access.