Embracing the Phone as a Token What You Need To Know Andy Kemshall Co-Founder

Transcription

1 Embracing the Phone as a Token What You Need To Know Andy Kemshall Co-Founder

2 What is 2FA? Setting the scene We use it every day ATM - Chip and PIN Two Factor is? Something you own - ATM card Something you know PIN, Secret, Password

3 Reuse Existing Database Standard Authentication Solutions SecurEnvoy Solution Re-enter user information Cost Database Database LDAP Sync Shouldn t change the schema Must be encrypted (FIPS 140 Replication bit AES) Active Directory Use AD or other LDAP as the database

4 Main Token types Hardware Tokens Tokenless Passcodes via SMS Soft Token applications Voice Tokens

5 Hardware Tokens Smart Cards Require readers and software driver certificate management Ipad? USB Sticks Require USB port, software driver, certificate management Ipad? Self contained Tokens

6 Self Contained Tokens Token Distribution 6 Months to deploy 1000 tokens via post 10% fail and need replacing every year 3 to 5 year life span Cost Up to 60% more expensive than tokenless Administration Cost Pin management Re-synchronisation Lost or broken token replacement Token Necklace!

7 Main Token types Hardware Tokens Tokenless Passcodes via SMS Soft Token applications Voice Tokens

8 What the Analysts say SMS OTP approaches the security of a dedicated hardware token, but at a lower cost and with higher convenience. - Gartner (G ) OTP Tokens, Weaknesses: High cost, Generally bulky - Gartner (G ) The mobile phone is the perfect user centric device for authenticating employees, internet banking customers and citizens into your network and will replace the hardware token as the de facto 2FA device. Alan Goode Managing Director, GI. Goode Intelligence predicts that within the next 18 months, hardware authentication vendors will lose market share to mobile phone authentication specialist vendors.

9 Main Token types Hardware Tokens Tokenless Passcodes via SMS Soft Token applications Voice Tokens

10 Passcodes via SMS UserID & Pin The Problem SMS Sent to Phone SMS delivery delays Expect around 4% of SMS messages to takes longer that 1 minute SLA s on delivery DON T cover sending to the user s phone Signal dead spots buildings with wide outer walls underground basements computer rooms Phone is used to connect to the internet Some phones can t receive SMS when a data connection is active 96% of text messages are delivered within 10 seconds source Vodafone

11 Passcodes via SMS Preloaded SMS Passcodes Passcode Andyk P0stcode Something You Know Something You Own Next Required Passcode Sent To Phone (overwrites previous message)

12 SMS Security Encrypted 4G has never been cracked 3G has never been cracked 2G compromised in2010 Security Patch Rolled Out

13 SMS Gateway Delivery Wrong Approach Limited SMS Gateways options Tied to one provider Be wary of hidden costs International coverage Telco SMS Provider Correct Approach Multiple SMS gateway options Intelligent routing Redundant failover Multiple methods competitive SMS providers brings lower costs

14 Main Token types Hardware Tokens Tokenless Passcodes via SMS Soft Token applications Voice Tokens

15 Soft Token Lifecycle Put iphone 4 iphone 5 Old Seed Deleted From Server New Seed Created No Additional Cost To Re-Deploy the new phone Cost

16 Option 2 Enrolment Security Random 1 st Seed Part Created Locally Seeds are NOT stored by manufacture AES 256 Bit Encrypted QRCode Scan Seed 1 st Part 8 Digit Code Seed 2nd Part Fingerprint of Phone 2nd Seed Part is recreated each time a passcode is created

17 Main Token types Hardware Tokens Tokenless Passcodes via SMS Soft Token applications Voice Tokens

18 Voice Tokens Why? User cannot receive SMS? User does not have a Smart phone Mobile phones banned from site MOD, OIL Rig Phone Network Session Locked Internet

19 Voice Token Voice Cost Passcode Cost Entry Andyk P0stcode CM AQL Answer the phone and enter on phones dial pad

20 Main Token types Hardware Tokens Cost Expensive to deploy and manage Passcodes via SMS Cost Soft Token application Cost Voice Tokens Cost Put the user in control, user can choose best method, allows unlimited seamless changing Cost

21