Let’s talk about End in End-to-End Trust, or, in other words, the Human Being.
Focus on the human subject – the beneficiary of technology
We’re pretty good at dealing with everything from the digital perimeter through to the protected resources the person wants to access. But the big problem, the very old problem, that we’ve made little progress in solving, is reliably and confidently authenticating the person to the digital perimeter. Let’s keep in mind the kind of attacks on information systems that we see everyday, the vast majority of them are attacking the Human being through some form of impersonation.
My thesis would be that we have extraordinary existing technology for securing everything within the digital workflow, but we are unbelievably immature in our current approaches to securely connecting the Human being (the physical world) to the digital world.
99% of protected resources still rely on Username/Password as the means for authentication of a human being. Let’s be clear about this, Username/Password does not authenticate a human being, it authenticates a directory entry.
We can talk about End-to-End trust forever, but until we can effectively manage the identity risk of human beings using Information Systems, the weakest link will continue to be end-user authentication and it will continue to be the primary focus of attacks.
The problem with traditional electronic identity credentials
Symmetric key cryptography, or shared secrets, is not an inherently weak form of authentication. It just happens that as its currently implemented though Username/Password across heterogeneous, monolithic systems it is wholly inadequate. Human beings are actually outrageously capable cryptographic processors. In fact, when it comes to communication, language, collaboration and knowledge, almost everything we do is rooted in our ability to perform millions of symmetric key cryptographic operations in real-time and, for the most part, sub-consciously.
Two quick examples should cement the point. The citrus fruit called orange, when ripe is also the color orange. At a very young age we’re taught to associate specific labels – red, orange, blue, etc., with specific frequencies of light. So the only reason 2 speakers refer to the color of an orange as orange is because we have a socially agreed upon set of key pairs. Language, alphabets, etc., all work the same way. The only reason I don’t know Chinese is because I’ve not learned those specific encryption/decryption algorithms.
Another example should cement the cryptographic nature of these relationships. Prior to going to a potentially boring party, I agree with my friend that if one of us says “how about those Red Sox”, we should both immediately initiate an exit strategy. Since we exclusively know the “code”, for all other participants in the conversation it is effectively “cyphertext.
Now, if you think about how many of these operations we constantly perform, for instance, as you’re reading this blog, you will get my point. Bottom-line, human beings are naturally really good at cryptography.
So why are Username/Passwords so bad? 3 reasons:
They are not easy to use. We don’t intuitively think of or recall 8+ character words with 1 upper-case alpha, 1 lower case alpha, one number and one non-alpha numeric. It’s get even harder when we have to change them every 90 days, and they must be different than the last 10 we used, and we’ve got 30 pairs of them to remember.
Compromise is hard to detect. They are typically static for long periods of time – like 90 days — and it’s not obvious to the end-user when someone else has compromised them.
They are not unique to the subject. Many people could have the same password, so there is nothing that inherently connects a password to an individual user.
Now contrast that with our ability to remember and recognize faces. Even though facial recognition is vastly more complicated then remembering an 8 character complex password, it is orders of magnitude easier and more intuitive for us to recognize faces, and this is just one example of many. Any of these things can be used as key material for symmetric crypto systems.
For electronic credentials to be effective and efficient there are a few properties they should exhibit:
Ease of use. They should be intuitive, leverage capabilities that we already possess and fit in with our lifestyles and work habits. That implies we need more then one. What may be an appropriate electronic credential when we’re authenticating to an ATM in a private vestibule, may not be appropriate when we’re attending a wedding or sitting in a lecture hall.
Easy to detect compromise. It should be obvious, in a short amount of time (minutes or hours vs. days or months) when a credential has been compromised. While it’s almost impossible to know someone’s stolen your password, it’s obvious, pretty quickly, when someone’s stolen your Blackberry.
They should be unique to you. At least one, and ideally, multiple components of a credential should be unique, ie., only 1 exists and it’s associated with you. That means when compromised it either no longer exists or is no longer associated with you.
Now, I’m not suggesting PIV cards and biometric readers for everyone. Quite the opposite, because they are terrible at 1 and only reasonably good at 2 and 3. What I’m suggesting is approaching the whole concept of electronic credentials from a totally different perspective.
People should be able to use whatever credential best suits the particular transaction, the physical and social environment in which they find themselves, and the capabilities they have at their immediate disposal.
Focus on the human subject – the beneficiary of technology
We’re pretty good at dealing with everything from the digital perimeter through to the protected resources the person wants to access. But the big problem, the very old problem, that we’ve made little progress in solving, is reliably and confidently authenticating the person to the digital perimeter. Let’s keep in mind the kind of attacks on information systems that we see everyday, the vast majority of them are attacking the human being through some form of impersonation.
My thesis would be that we have extraordinary existing technology for securing everything within the digital workflow, but we are unbelievably immature in our current approaches to securely connecting the human being (the physical world) to the digital world.
99% of protected resources still rely on Username/Password as the means for authentication of a human being. Let’s be clear about this, Username/Password does not authenticate a human being, it authenticates a directory entry.
We can talk about End-to-End trust forever, but until we can effectively manage the identity risk of human beings using Information Systems, the weakest link will continue to be end-user authentication and it will continue to be the primary focus of attacks.
(more…)
