Authentication - a market update

ENGLAND, UK: 123456! Amazingly, surveys show that this is the most popular password for authentication. And simple passwords are still the most used authentication method. However, popularity, in this case, just doesn't equate with success.

Security breaches are becoming a daily occurrence and high profile companies such as Yahoo, Target (was the clue in the name) and Tesco are just some of the famous names amongst the victims of password theft.

Recently, on a Netherlands server, researchers discovered compromised credentials for more than 93,000 websites, including 318,000 Facebook accounts, 70,000 Gmail, Google+ and YouTube accounts, 60,000 Yahoo accounts, 22,000 Twitter accounts and 8,000 LinkedIn accounts. These are just some names from a very long list.

However, these public lists, huge as they are, represent just a fraction of the organisations suffering from password theft. The majority of organisations affected have neither any requirement to notify anyone (as it affects their business and their staff, but not consumers), nor have they been "outed" publicly.

So, we have a long established way of doing things, that is proven on a daily basis to be inadequate and insecure, yet the majority of companies still use it. How long will this state of affairs last? Will we see another decade of consistent, repetitive authentication failures?

The short answer is no. The slightly longer answer is that the Darwin principle will ensure that doesn't happen. Those affected by password theft will either come up to the mark, and improve their authentication, or decline and go out of business.

The real answer is that strong authentication is on a high growth curve, driven by the multiple waves of change rolling across organisations, both small and large.

There are many reasons for these changes. Recent developments in computing have led to increasingly fractured and distributed networks, which are harder to protect. More people are trying to access the network from more locations, so it's much harder to keep track of who is on the network and whether they have a right to be there.

The reasons for increasingly distributed networks include the growth of mobile computing, remote access, tablets, smartphones and BYOD. The growing popularity of wireless, the cloud, virtualisation and the increasing use of social networking are also making inadequately protected networks easier to breach.

Alongside the increasing insecurity of today's networks, there has been a rapid growth of data, coupled ironically with both greater dispersal and greater agglomeration of data in data centres, meaning there is even more to protect than ever before.

Authentication is the most basic step towards protecting networks and while passwords still have a role, that role is increasingly as part of a multi-factor authentication process. This is being driven by a range of issues, including rapid changes to risk profiles and greater awareness of two factor authentication.

Other factors driving the move towards strong authentication include the increasing pressures on companies to achieve security compliance, with the consequences of failure including hefty ICO fines and possible reputational damage.

Newer standards such as the PCI DSS (Payment Card Industry Data Security Standard) and GCSX (Government Connect Secure Extranet) have brought greater awareness of the need for security compliance to a much wider range of organisations.

Greater press coverage of computer security failures, including the insecurity of mobiles devices and smartphones, has also had an effect, creating more visibility of the problems. Organisations are now becoming much more concerned about taking positive steps to protect their networks, their data and their reputations.

Authentication types - benefits and disadvantages

Getting the right kind of authentication needs careful thought. A key question is "Is the authentication method something that staff can use relatively easily?" Get something too complicated and you could have problems.

Another key issue is using the right level of authentication needed. Do you need different levels of authentication for different staff, for different applications, for different departments? Is your authentication method flexible enough to cope with that?

Broadly speaking, users are looking for authentication methods that provide the best combination of ease-of-use, security, and, of course, cost. Currently, the main options are:

- weak single-factor authentication (passwords)

- strong complex passwords, usually with a minimum of characters, including special characters, and recommended to be regularly changed

- strong two-factor authentication (passwords + something else, such as a token)

- strong three-factor authentication (passwords + something else, such as a soft token + a mobile phone).

Weak single factor authentication (passwords)

This is the use of single static passwords, still the most common form of authentication and used by most organisations. However, companies are increasingly aware that even if they continue with passwords for part of their workforce, there are employee types such as power workers, knowledge workers, mobile workers and remote workers, where proof of identity is important.

Any password system not collecting and storing passwords in a secure (encrypted) format is fundamentally vulnerable.

Encrypted passwords

While encrypted passwords are more secure than simple passwords, and superficially secure, they are actually at risk of attack by various methods.

Brute force attacks and dictionary attacks are common, as are rainbow tables. Rainbow tables are essentially pre-calculation tables of hashed passwords, with plaintext already deciphered, that are just compared to identify matches. This process uses minimal CPU resource, compared with cracking encryption.

Strong complex passwords

That's what many of us use to access our secure online areas and are used in companies to overcome the disadvantages of weak passwords. For passwords to provide protection in a business environment, they need to be not only strong, and typically including special characters or numbers, but also different for different applications, and changed regularly.

Strong complex passwords, when encrypted, are significantly less vulnerable to rainbow tables and similar methods. They are however vulnerable, as many users employ the same passwords for social and online sites as for their business. Any breach of the external password, either through poor security or social engineering, can break security for the business, or vice-versa.

Strong authentication

Strong authentication involves one of a range of elements such as hardware tokens, soft tokens, fingerprint recognition, swipe cards and phone as a token, or phone as a recipient of a soft token. Most strong authentication deployments are used together with passwords (two-factor authentication).

Strong two-factor authentication

Strong two factor authentication is a much more secure means of authenticating users onto networks, as it requires two separate security elements.

It comprises something you know (a password) and something you have, e.g. a token, which generates a one-time password (OTP) or a fingerprint. Software and hardware tokens are currently the most popular two-factor solutions, due to their low cost, ease- of-deployment, ease-of-management and the standard of security they provide.

According to Gartner, hardware tokens still have the largest installed base of any method (70 percent). In the last few years, however, there has been a shift away from the use of specific hardware tokens to the deployment of other types of tokens, including mobile phones, and hardware USBs, such as SafeStick or Ironkey.

The rapid fall in the price of tokens means they are now available from only a few pounds per user per year. To put that in perspective, it's less than the cost of ONE password-related helpdesk call. With password-connected calls making up a significant percentage of helpdesk calls (depending on whose research you accept), tokens can represent a major cost-saving as well as an improvement in security.

Strong three-factor authentication

This is far superior and involves something you know (e.g. password), something you have (e.g. authentication token) and something you are (e.g. fingerprint, retinal scan, facial recognition). While biometric authentication is obviously more costly and complicated to use, it is appropriate for high security applications/departments such as

pharmaceutical R&D, finance, etc.

Contextual authentication

Contextual authentication is a method which is growing, but not yet mainstream. It uses contextual information (such as users' behaviour patterns) to decide whether a user is genuine. It can improve on the use of a password, without the need for traditional two factor strong authentication.

Mobile devices can play a significant role in contextual authentication. They can capture relevant contextual information such as tapping rhythm, voice recognition, facial contours, and iris details. However, as yet, this kind of mobile-related, contextual authentication is only used for a minority of higher security applications.

A strategic view

A growing trend amongst enterprises is to take a more strategic view of authentication. Companies are acknowledging they may need different levels of authentication for different scenarios, different users and different applications. They are looking for one flexible authentication method which can facilitate these different levels. Currently, however, most enterprises and SMEs still tend to use a single authentication method.

The cloud

The popularity of the cloud should be noted, with researchers predicting that by year-end 2016, about 30 percent of enterprises will choose cloud-based services as their delivery option for new or refreshed user authentication implementations - up from about 10 percent today.

Mobile devices

Smartphones and mobile devices are playing a growing part in the authentication scenario. They are already widely used as authentication tokens; they function as fairly powerful computers and are an endpoint in themselves, so need protecting; and they can be used for biometric and contextual authentication.

Market leaders

Two of the leaders in Gartner's Magic Quadrant for User Authentication are VASCO and SafeNet. Looking at their product ranges gives us a more practical idea of what authentication methods are available today and how they are delivered.

VASCO is a well-known name in authentication and has one of the widest ranges of authentication methods currently available. It is a leading supplier of strong authentication, e-signature solutions and services, specialising in Internet security applications and transactions.

The company is very strong in the financial sector, government, enterprises and e-commerce, with solutions for companies from SMEs up to the largest enterprises. Gartner says VASCO has a "very strong position in this market" and calls the company "a very strong innovator."

Authentication platforms include IDENTIKEY (server software), IDENTIKEY Virtual Appliance, IDENTIKEY Appliance (a hardware appliance), IDENTIKEY Federation Server (a higher end server appliance), DIGIPASS as a Service (private cloud service), MYDIGIPASS.COM (public cloud service) and VACMAN Controller (API-based authentication library).

SMEs

One solution for small businesses from VASCO is DIGIPASS Pack for Remote Authentication. This is an out-of-the-box solution which combines all necessary hardware and software to provide a high level of security to organisations with limited resources and budgets.

SAFENET

Gartner says that SafeNet "demonstrated a very sound market understanding, as well as very strong product strategy and innovation." Gartner also says "SafeNet has a strong position in this market (customer numbers are in the highest tier)."

SafeNet itself says it has a vision to make two-factor authentication universally available and that it provides inexpensive, easy-to-use, innovative solutions to a large range of clients, worldwide. Clients are in business, government and non-profit organisations.

Maintaining a security posture that mandates user PINs that are long and complex results in significantly increased help desk calls and dissatisfied users due to the frequency and frustration of forgotten PINs. However, maintaining simple PINs and reducing the security posture means passcode length and complexity become more important. With SafeNet Authentication Service's flexible tokens, you can control both.

The author is chairman Wick Hill Group, UK.