Strong security is just common sense
by Andy Kemshall - SecurEnvoy CTO and co-founder - Friday, 23 September 2011.
For many years those who concerned themselves with an organization's cyber security warned of threats, both internal and external, urging organizations to adequately protect themselves. Unfortunately the message either went unheeded, or the security measures implemented were insufficient, as we’ve seen headline after headline of victims who’ve suffered a breach. While the severity may vary, each is an example of the concerned organization's security measures being found wanting.

And the battle has only just begun as, in recent months, security professionals have amplified the cry following attacks from DigiNotar, Anonymous and WikiLeaks – and the list goes on. Organizations need to get a grip on their borders, now, or risk losing the cyber fight and becoming another statistic.

Strong foundations

The threats an organization faces are multifaceted. While it’s possible, and perhaps tempting, to spend millions plugging every hole the reality is it’s impractical. Instead a more common sense approach to security is required.

At the heart of the problem is that, with every breach incident, the likelihood of a user’s identity having been compromised increases. Therefore, it doesn’t matter how intrinsic the overarching security approach, it is fundamentally flawed if you fail to establish that the person gaining access is who they claim to be. For example, while a VPN provides a secure communication tunnel, if a hacker can mimic a legitimate user and use their key to open the pipe then everything traveling down it is insecure.

Physical security is common sense in a virtual world too

In the real world we regularly use Chip and Pin to make a purchase in the high street, or withdraw cash from an ATM. Quite simply this is two factor authentication in action in the real world.

Before clarifying what constitutes two factor authentication, it is probably worth stating what it is not. A password on a PC (often referred to as single factor authentication) is the equivalent of a basic lock – only slightly better than nothing. It stands to reason that two passwords - even if one is a data pattern or random characters from a memorable phrase, it is actually just two locks. Although it may slow an intruder by having another password, common sense should tell you it still isn’t adequate.

Two factor authentication, in its very basic sense, is the combination of two different elements from a choice of three:
  • Something you know – such as a pin or password
  • Something you own – such as a key, token or the chip embedded in a credit card
  • Something specific to the person – such as a fingerprint, or retina.
The downside of something specific to the person, or biometrics as it’s widely referred, is hardware. A physical reader needs to be installed at each point of entry from where a user may authenticate. In today’s modern society users want to use a myriad of devices, and places, to access the corporate network – be it laptop, iphone, cyber café PC, etc. It makes the ‘specific’ element either very expensive when accommodating every possible access point or simply impractical. A further consideration, given the changing pace of technology, is whether a biometric system will be adaptable to tomorrow’s devices?

This leaves the combination of something you know and something you own as the only practical two factor authentication solution.

The keys to the vault

Something you own invariably means a security token. There are two types – hardware-based i.e. a physical token and software based, such as an SMS-based token received on a mobile phone - often described as a tokenless two-factor-authentication system.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Mon, Feb 8th