Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Implementing Multi-factor Auth (dotSecurity 2016)

Implementing Multi-factor Auth (dotSecurity 2016)

Jacob Kaplan-Moss

April 22, 2016
Tweet

More Decks by Jacob Kaplan-Moss

Other Decks in Technology

Transcript

  1. @jacobian 1. Possession factor options 2. Implementation questions 3. Two

    recommendations: a. MFA for public-facing services b. MFA for internal systems
  2. @jacobian 1. Possession factor options 2. Implementation questions 3. Two

    recommendations: a. MFA for public-facing services b. MFA for internal systems
  3. @jacobian Risks Can codes be intercepted? Re-used? Brute-forced? Would a

    token theft/re-use be noticed? How secure against malware is the factor?
  4. @jacobian Out-of-band communication: Risks Communications can be intercepted Users will

    set up forwarding schemes Can be compromised by device malware Delivery is usually to the same device being used UX users are familiar with with SMS easy setup for users re-uses devices users already have typing codes is error-prone, not suitable for frequent auths delays in delivery can cause timeouts, frustrating users Cost Typically free for users. Minimal delivery cost for providers (~ $0.01/message)
  5. @jacobian Soft tokens Risks Can be compromised by device malware.

    Typically based around a shared secret, which can be silently stolen. Time-based tokens are vulnerable to theft, brute-forcing, and re-use. Delivery is usually to the same device being used. UX re-uses devices users already have relatively familiar (to experienced users, at least) enrollment can be confusing (TOTP) time skew on devices can make implementation difficult Cost Free to users. Provider costs range from free (e.g. TOTP) to several $/user.
  6. @jacobian Hard tokens Risks “Master keys” can be stolen UX

    “just press the button”; can be suitable for frequent auths some tokens can also be used for encryption, signing lost tokens can mean long lockouts no real standards mean token proliferation Cost At least $20 per user
  7. @jacobian 1. Possession factor options 2. Implementation questions 3. Two

    recommendations: a. MFA for public-facing services b. MFA for internal systems
  8. @jacobian When should you require a 
 possession factor? Good:

    upon every login Better: ... and when performing sensitive actions
  9. @jacobian When should you require a 
 possession factor? Good:

    upon every login Better: ... and when performing sensitive actions Best: ... and based on behavioral analysis
  10. @jacobian Backup codes? (users don’t save them) Backup phone/emails? (expands

    attack surface) “Contact support”? How should we handle lost tokens?
  11. @jacobian Backup codes? (users don’t save them) Backup phone/emails? (expands

    attack surface) “Contact support”? (vulnerable to social engineering) How should we handle lost tokens?
  12. @jacobian Backup codes? (users don’t save them) Backup phone/emails? (expands

    attack surface) “Contact support”? (vulnerable to social engineering) “sorry; deal with it ”? How should we handle lost tokens?
  13. @jacobian Backup codes? (users don’t save them) Backup phone/emails? (expands

    attack surface) “Contact support”? (vulnerable to social engineering) “sorry; deal with it ”? (not very user-friendly) How should we handle lost tokens?
  14. @jacobian 1. Possession factor options 2. Implementation questions 3. Two

    recommendations: a. MFA for public-facing services b. MFA for internal systems
  15. @jacobian MFA for public-facing systems: Factor: Require MFA: Lost tokens:

    Out-of-band communication, or good soft token implementation (Authy)
  16. @jacobian MFA for public-facing systems: Factor: Require MFA: Lost tokens:

    Out-of-band communication, or good soft token implementation (Authy) at login, and when performing sensitive actions
  17. @jacobian MFA for public-facing systems: Factor: Require MFA: Lost tokens:

    Out-of-band communication, or good soft token implementation (Authy) at login, and when performing sensitive actions backups codes & phone/email backup; don’t allow support to reset MFA
  18. @jacobian MFA for internal systems: Factor: Require MFA: Lost tokens:

    hard tokens (U2F or Yubikey) based on behavior analysis
  19. @jacobian MFA for internal systems: Factor: Require MFA: Lost tokens:

    hard tokens (U2F or Yubikey) based on behavior analysis until real-life identity verification
  20. Credits: Slide deck based on a template by Alice Bartlett:

    http://alicebartlett.co.uk/blog/how-to-do-ok-at-slides. Font: Roboto, by Christian Robertson https://www.fontsquirrel.com/fonts/roboto. Photos by: - Unsplash, https://unsplash.com/ - #WOCinTech/#WOCinTech Chat, http://www.wocintechchat.com/ (see slides for individual credits).