Cloud sicherung durch Adaptive Multi-factor Authentication

Transcription

1 Cloud sicherung durch Adaptive Multi-factor Authentication Lars Gotlieb Regional manager DACH

2 Marktbewährte Technologie Selected References 2

3 Marktbewährte Technologie Selected retail References 4

4 Fast Growing Threats Hacking Hacking is the fastest growing crime type Ransomware victims per day in 2014 Targeted Attacks From Targeted Attacks grew 62% Size doesn t matter 32% of attacks were aimed at companies with less than 250 employees $ 76% of all network breaches involve weak or stolen passwords 5

5 A Lethal Cocktail Ingredients: More users access more information Access from multiple devices and locations More data stored in the Cloud Hackers target everyone Data protected with just a password High risk for loss of data 6

6 The World has Changed Increasingly mobile workforce Lack of visibility and control Rise of Cloud Applications By 2016, 25% of enterprises will secure access to cloud-based services using a CASB platform, up from less than 1% in 2012, reducing the cost of securing access by 30% - Gartner

7 Censornet The only way to completely protect your data A Person In a Context Location, Devise, Public or Private network With Data Accesses an Applicati on To perform a function

8 The Evolution of Authentication 25 years of strong user authentication can be described in three phases: High risk segment Financial and governmental institutions, in particular security oriented branches of government puts Hardware Tokens into use Likelihood of attacks, loss of data, remote access, systems, number of users, etc. VPN / SSL, Citrix, OWA, SharePoint, CRM, Web, ActiveSync, etc. 10+ Large enterpirses Larger organizations across industries realise the need and Two-factor authentication becomes a security best practice Everyone is a target Hacking is a frequent part of the news cycle. Ransomware, APT, etc. are actual threats, keyloggers and other malware are dispersed across the net, and everyone becomes a target VPN 1 Banks, Police etc. 90s VPN, Citrix, OWA 3 Best Practice 00s All Organizations 10s Time 1 st Generation Hard Tokens 2 nd Generation Mobile-based 3 rd Generation Intelligent MFA 9

9 Demonstration 10

10 Security Security Real-time Authentication» No pre-issued passcodes» No seed files» Precondition for Session-specific OTP s» User notification capabilities 14

11 Security High Passcode Security Our One-Time-Passcodes are:» Challenge-based» Real-time» Session-specific (avoid Phishing!)» Time-restricted (default = 2 minutes)» Configurable number of characters (default = 6 characters)» Cryptographically Strong Random Codes (FIPS-140) The RNGCryptoServiceProvider generates cryptographically strong random numbers and has completed FIPS-140 evaluation. 16

12 Convenience Adaptive User Authentication» Allows for a more convenient login when acceptable» IP address, policies (system, country etc.) and groups defines the login flow» Differences between regions, security groups etc. is possible Login Trust?? Trust? Non-trusted Trusted OTP Welcome! 19

13 Flexible OTP Delivery Administration Administration» Broad range of OTP delivery options» Automatic failover» Location Aware Dispatching» OATH token support allows use of both hardware- and App tokens» Simultaneous use is possible 29

14 Gelobte support! Hello colleagues, with the super-fast help of the SMS Passcode support, the problem could be fixed within some minutes. Fastest support we ve ever had. Thank you! Udo Nassenstein IT Operations Daimler FleetBoard GmbH SMS passcode -

15 Keeping you safe Without spoiling the ride

16 Questions? 40

17 BACKUP SLIDES 41

18 Customer Satisfaction Customer Satisfaction 2014 Likelyhood to recommend SMS PASSCODE Highly satisfied 59% Very likely 56% Satisfied 40% Likely 38% Less satisfied 1% Don't know Unlikely 5% 1% 0% 20% 40% 60% 80% 0% 10% 20% 30% 40% 50% 60% This project has been highly successful. Not only have we realized substantial cost savings, the users have also been very happy about the change. John Gudmann, Post Nord We have now regained control of the authentication process. We know exactly who receives access codes, when they use them to log in, and from where. Peter Warnier, CIO, DEME Hello colleagues, With the super-fast help of the SMS PASSCODE support, the problem could be fixed within some minutes. Fastest support we ve ever had. Udo Nassenstein, Daimler FleetBoard GmbH 42

19 The Evolution of Authentication Technology 1 st Generation 2 nd Generation 3 rd Generation s Hardware Tokens 00 s Mobile based solutions Now Adaptive User Authentication + Introduction of two-factor auth. High cost on tokens Distribution & administration cost An extra thing to carry + Real-time multi-factor auth. + No hardware distribution Deployment of soft tokens / apps Regional SMS delivery challenges + Contextual intelligence layer + Policy-based trusted IPs + Multiple OTP options + Location aware dispatching Our Heritage: Always been based on SMS Always been real-time Always been session based No client software 43

20 Two-factor vs. Multi-factor Authentication» Two-factor Authentication (2FA) is merely» Something you Know» Something you Have (Token, Card, Finger, Phone etc.) Basic security: Protects against 90 ies threats (key loggers, guessed/ cracked/ bought/ borrowed passwords etc.) Plus - users feel that their identity is protected.» Multi-Factor Authentication (MFA) simply adds more factors» Your Connection (unique session identification)» Your Location (Geographically)» The Role/Rights you have (Group member i.e. consultant, employee)» A valid Gateway/Point of entry» Time of day (doors are open only between i.e. 8am and 10pm) etc. Higher security: Protection against also more modern threats like Advanced malware, Session hijacking, Phishing, Pharming, Man-inthe-middle attacks etc. New flexibility: Access may now be controlled based on i.e. Countries, IP-ranges, Trusted locations, Time frames, Roles, Groups and other factors. 44

21 Platform Diagram 45

22 Secure Device Provisioning» SMS PASSCODE automates authentication for native e- mail client usage» Works directly with the Allow/Block/Quarantine list in Exchange ActiveSync» Users can safely self-provision new devices 46

23 Password Reset Module» Users do not need to know about the solution no education needed» Automatic notification at or before password expiry» Convenient password reset from any mobile, tablet, or PC» No client software needed to perform password reset» The solution adapts the level of authentication required to reset the password based on the users location 11:45 am Your account password will expire in 3 days. Please reset your password here: Intuitive Password Reset website guides the users through the process 47